diff --git a/DEPS b/DEPS
index 0b8613a..37dd05f 100644
--- a/DEPS
+++ b/DEPS

@@ -40,11 +40,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '36c60c9777fc8635f6538db2c67da69ec07b2ef3',
+  'skia_revision': 'dbb24efcc5f224a0d9a73ad9b200daf8013df0a1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'efa2ac4129d30c7c72e84c16af3d20b44829f990',
+  'v8_revision': '8cd4009c5b7072ad224f19a9e668ec0ed7430599',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -1225,7 +1225,7 @@
       'action': [
         'python',
         'src/build/fuchsia/update_sdk.py',
-        '2947889cf6f6a53dcd9826e4ce41316920fcb05c',
+        'd9ccb5f3ba70118dba419f8202ebd74613005c9c',
       ],
     },
   ],

diff --git a/WATCHLISTS b/WATCHLISTS
index 0e677db..9a59c48a 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS

@@ -1107,6 +1107,9 @@
     'mojo': {
       'filepath': 'mojo',
     },
+    'mojo_top_level_directory': {
+      'filepath': '^mojo/',
+    },
     'mouse_lock': {
       'filepath': 'mouse_lock',
     },
@@ -1349,6 +1352,9 @@
     'service_worker': {
       'filepath': 'content/(browser|renderer|child|common)/service_worker/',
     },
+    'services_network': {
+      'filepath': 'services/network',
+    },
     'services_public': {
       'filepath': 'services/([^/]*/)*public/',
     },
@@ -1952,7 +1958,8 @@
                        'rdsmith+watch@chromium.org'],
     'content_network': ['asanka@chromium.org',
                         'rdsmith+watch@chromium.org',
-                        'kinuko@chromium.org'],
+                        'kinuko@chromium.org',
+                        'yzshen+watch@chromium.org'],
     'content_renderer': ['mlamouri+watch-content@chromium.org'],
     'content_shell': ['jochen+watch@chromium.org',
                       'mlamouri+watch-content@chromium.org',
@@ -2104,8 +2111,8 @@
              'abarth@chromium.org',
              'darin@chromium.org',
              'qsr+mojo@chromium.org',
-             'viettrungluu+watch@chromium.org',
-             'yzshen+watch@chromium.org'],
+             'viettrungluu+watch@chromium.org'],
+    'mojo_top_level_directory': ['yzshen+watch@chromium.org'],
     'mouse_lock': ['scheib+watch@chromium.org'],
     'mus': ['rjkroege@chromium.org'],
     'nacl': ['native-client-reviews@googlegroups.com'],
@@ -2203,6 +2210,7 @@
                        'serviceworker-reviews@chromium.org',
                        'shimazu+serviceworker@chromium.org',
                        'tzik@chromium.org'],
+    'services_network': ['yzshen+watch@chromium.org'],
     'services_public': ['blundell+services-watchlist@chromium.org'],
     'settings_reset_prompt': ['alito+watch@chromium.org'],
     'site_engagement': ['dominickn+watch@chromium.org'],

diff --git a/ash/accelerators/accelerator_controller.cc b/ash/accelerators/accelerator_controller.cc
index 2abfc9c..c09c3c1 100644
--- a/ash/accelerators/accelerator_controller.cc
+++ b/ash/accelerators/accelerator_controller.cc

@@ -9,6 +9,7 @@
 #include "ash/accelerators/accelerator_commands.h"
 #include "ash/accelerators/accelerator_controller_delegate.h"
 #include "ash/accelerators/debug_commands.h"
+#include "ash/accessibility/accessibility_controller.h"
 #include "ash/accessibility_delegate.h"
 #include "ash/accessibility_types.h"
 #include "ash/display/display_configuration_controller.h"
@@ -738,7 +739,9 @@
   message_center::MessageCenter::Get()->AddNotification(
       std::move(notification));
 
-  Shell::Get()->accessibility_delegate()->ToggleHighContrast();
+  AccessibilityController* controller =
+      Shell::Get()->accessibility_controller();
+  controller->SetHighContrastEnabled(!controller->IsHighContrastEnabled());
 }
 
 void HandleToggleSpokenFeedback() {

diff --git a/ash/accessibility/accessibility_controller.cc b/ash/accessibility/accessibility_controller.cc
index 4b045c4..d2b07e5 100644
--- a/ash/accessibility/accessibility_controller.cc
+++ b/ash/accessibility/accessibility_controller.cc

@@ -4,7 +4,9 @@
 
 #include "ash/accessibility/accessibility_controller.h"
 
+#include "ash/high_contrast/high_contrast_controller.h"
 #include "ash/public/cpp/ash_pref_names.h"
+#include "ash/public/cpp/config.h"
 #include "ash/session/session_controller.h"
 #include "ash/session/session_observer.h"
 #include "ash/shell.h"
@@ -14,6 +16,9 @@
 #include "components/prefs/pref_change_registrar.h"
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
+#include "services/service_manager/public/cpp/connector.h"
+#include "services/ui/public/interfaces/accessibility_manager.mojom.h"
+#include "services/ui/public/interfaces/constants.mojom.h"
 #include "ui/base/cursor/cursor_type.h"
 
 namespace ash {
@@ -26,7 +31,9 @@
 
 }  // namespace
 
-AccessibilityController::AccessibilityController() {
+AccessibilityController::AccessibilityController(
+    service_manager::Connector* connector)
+    : connector_(connector) {
   Shell::Get()->session_controller()->AddObserver(this);
 }
 
@@ -60,10 +67,8 @@
 
 void AccessibilityController::SetLargeCursorEnabled(bool enabled) {
   PrefService* prefs = GetActivePrefService();
-  // Null early in startup.
   if (!prefs)
     return;
-
   prefs->SetBoolean(prefs::kAccessibilityLargeCursorEnabled, enabled);
   prefs->CommitPendingWrite();
 }
@@ -72,6 +77,18 @@
   return large_cursor_enabled_;
 }
 
+void AccessibilityController::SetHighContrastEnabled(bool enabled) {
+  PrefService* prefs = GetActivePrefService();
+  if (!prefs)
+    return;
+  prefs->SetBoolean(prefs::kAccessibilityHighContrastEnabled, enabled);
+  prefs->CommitPendingWrite();
+}
+
+bool AccessibilityController::IsHighContrastEnabled() const {
+  return high_contrast_enabled_;
+}
+
 // static
 bool AccessibilityController::RequiresCursorCompositing(PrefService* prefs) {
   return prefs->GetBoolean(prefs::kAccessibilityLargeCursorEnabled) ||
@@ -92,8 +109,13 @@
       prefs::kAccessibilityLargeCursorDipSize,
       base::Bind(&AccessibilityController::UpdateLargeCursorFromPref,
                  base::Unretained(this)));
+  pref_change_registrar_->Add(
+      prefs::kAccessibilityHighContrastEnabled,
+      base::Bind(&AccessibilityController::UpdateHighContrastFromPref,
+                 base::Unretained(this)));
 
   UpdateLargeCursorFromPref();
+  UpdateHighContrastFromPref();
 }
 
 void AccessibilityController::SetPrefServiceForTest(PrefService* prefs) {
@@ -131,4 +153,31 @@
   Shell::Get()->SetCursorCompositingEnabled(RequiresCursorCompositing(prefs));
 }
 
+void AccessibilityController::UpdateHighContrastFromPref() {
+  PrefService* prefs = GetActivePrefService();
+  const bool enabled =
+      prefs->GetBoolean(prefs::kAccessibilityHighContrastEnabled);
+
+  if (high_contrast_enabled_ == enabled)
+    return;
+
+  high_contrast_enabled_ = enabled;
+
+  NotifyAccessibilityStatusChanged();
+
+  // Under mash the UI service (window server) handles high contrast mode.
+  if (Shell::GetAshConfig() == Config::MASH) {
+    if (!connector_)  // Null in tests.
+      return;
+    ui::mojom::AccessibilityManagerPtr accessibility_ptr;
+    connector_->BindInterface(ui::mojom::kServiceName, &accessibility_ptr);
+    accessibility_ptr->SetHighContrastMode(enabled);
+    return;
+  }
+
+  // Under classic ash high contrast mode is handled internally.
+  Shell::Get()->high_contrast_controller()->SetEnabled(enabled);
+  Shell::Get()->SetCursorCompositingEnabled(RequiresCursorCompositing(prefs));
+}
+
 }  // namespace ash

diff --git a/ash/accessibility/accessibility_controller.h b/ash/accessibility/accessibility_controller.h
index 6c14856..db7206d 100644
--- a/ash/accessibility/accessibility_controller.h
+++ b/ash/accessibility/accessibility_controller.h

@@ -16,6 +16,10 @@
 class PrefRegistrySimple;
 class PrefService;
 
+namespace service_manager {
+class Connector;
+}
+
 namespace ash {
 
 // The controller for accessibility features in ash. Features can be enabled
@@ -23,7 +27,7 @@
 // Uses preferences to communicate with chrome to support mash.
 class ASH_EXPORT AccessibilityController : public SessionObserver {
  public:
-  AccessibilityController();
+  explicit AccessibilityController(service_manager::Connector* connector);
   ~AccessibilityController() override;
 
   // See Shell::RegisterProfilePrefs().
@@ -32,6 +36,9 @@
   void SetLargeCursorEnabled(bool enabled);
   bool IsLargeCursorEnabled() const;
 
+  void SetHighContrastEnabled(bool enabled);
+  bool IsHighContrastEnabled() const;
+
   // Returns true if an accessibility feature is enabled that requires cursor
   // compositing.
   static bool RequiresCursorCompositing(PrefService* prefs);
@@ -43,15 +50,18 @@
 
  private:
   // Before login returns the signin screen profile prefs. After login returns
-  // the active user profile prefs.
+  // the active user profile prefs. Returns null early during startup.
   PrefService* GetActivePrefService() const;
 
   void UpdateLargeCursorFromPref();
+  void UpdateHighContrastFromPref();
 
+  service_manager::Connector* connector_ = nullptr;
   std::unique_ptr<PrefChangeRegistrar> pref_change_registrar_;
 
   bool large_cursor_enabled_ = false;
   int large_cursor_size_in_dip_ = kDefaultLargeCursorSize;
+  bool high_contrast_enabled_ = false;
 
   PrefService* pref_service_for_test_ = nullptr;
 

diff --git a/ash/accessibility/accessibility_controller_unittest.cc b/ash/accessibility/accessibility_controller_unittest.cc
index d6d0132..ff12e1f 100644
--- a/ash/accessibility/accessibility_controller_unittest.cc
+++ b/ash/accessibility/accessibility_controller_unittest.cc

@@ -86,4 +86,24 @@
             prefs->GetInteger(prefs::kAccessibilityLargeCursorDipSize));
 }
 
+TEST_F(AccessibilityControllerTest, SetHighContrastEnabled) {
+  AccessibilityController* controller =
+      Shell::Get()->accessibility_controller();
+  EXPECT_FALSE(controller->IsHighContrastEnabled());
+
+  TestAccessibilityObserver observer;
+  Shell::Get()->system_tray_notifier()->AddAccessibilityObserver(&observer);
+  EXPECT_EQ(0, observer.changed_);
+
+  controller->SetHighContrastEnabled(true);
+  EXPECT_TRUE(controller->IsHighContrastEnabled());
+  EXPECT_EQ(1, observer.changed_);
+
+  controller->SetHighContrastEnabled(false);
+  EXPECT_FALSE(controller->IsHighContrastEnabled());
+  EXPECT_EQ(2, observer.changed_);
+
+  Shell::Get()->system_tray_notifier()->RemoveAccessibilityObserver(&observer);
+}
+
 }  // namespace ash

diff --git a/ash/accessibility_delegate.h b/ash/accessibility_delegate.h
index 480d480..4fe1496 100644
--- a/ash/accessibility_delegate.h
+++ b/ash/accessibility_delegate.h

@@ -28,12 +28,6 @@
   // Returns true if spoken feedback is enabled.
   virtual bool IsSpokenFeedbackEnabled() const = 0;
 
-  // Invoked to toggle high contrast mode for accessibility.
-  virtual void ToggleHighContrast() = 0;
-
-  // Returns true if high contrast mode is enabled.
-  virtual bool IsHighContrastEnabled() const = 0;
-
   // Invoked to enable the screen magnifier.
   virtual void SetMagnifierEnabled(bool enabled) = 0;
 

diff --git a/ash/default_accessibility_delegate.cc b/ash/default_accessibility_delegate.cc
index 26bf6bfe..226b08d 100644
--- a/ash/default_accessibility_delegate.cc
+++ b/ash/default_accessibility_delegate.cc

@@ -19,14 +19,6 @@
   return spoken_feedback_enabled_;
 }
 
-void DefaultAccessibilityDelegate::ToggleHighContrast() {
-  high_contrast_enabled_ = !high_contrast_enabled_;
-}
-
-bool DefaultAccessibilityDelegate::IsHighContrastEnabled() const {
-  return high_contrast_enabled_;
-}
-
 void DefaultAccessibilityDelegate::SetMagnifierEnabled(bool enabled) {
   screen_magnifier_enabled_ = enabled;
 }
@@ -116,10 +108,12 @@
 }
 
 bool DefaultAccessibilityDelegate::ShouldShowAccessibilityMenu() const {
-  return spoken_feedback_enabled_ || high_contrast_enabled_ ||
-         screen_magnifier_enabled_ || autoclick_enabled_ ||
-         virtual_keyboard_enabled_ || mono_audio_enabled_ ||
-         Shell::Get()->accessibility_controller()->IsLargeCursorEnabled();
+  AccessibilityController* controller =
+      Shell::Get()->accessibility_controller();
+  return spoken_feedback_enabled_ || screen_magnifier_enabled_ ||
+         autoclick_enabled_ || virtual_keyboard_enabled_ ||
+         mono_audio_enabled_ || controller->IsLargeCursorEnabled() ||
+         controller->IsHighContrastEnabled();
 }
 
 bool DefaultAccessibilityDelegate::IsBrailleDisplayConnected() const {

diff --git a/ash/default_accessibility_delegate.h b/ash/default_accessibility_delegate.h
index e1187c6..c7b28d4 100644
--- a/ash/default_accessibility_delegate.h
+++ b/ash/default_accessibility_delegate.h

@@ -18,8 +18,6 @@
   ~DefaultAccessibilityDelegate() override;
 
   bool IsSpokenFeedbackEnabled() const override;
-  void ToggleHighContrast() override;
-  bool IsHighContrastEnabled() const override;
   void SetMagnifierEnabled(bool enabled) override;
   bool IsMagnifierEnabled() const override;
   void SetAutoclickEnabled(bool enabled) override;
@@ -60,7 +58,6 @@
 
  private:
   bool spoken_feedback_enabled_ = false;
-  bool high_contrast_enabled_ = false;
   bool screen_magnifier_enabled_ = false;
   bool autoclick_enabled_ = false;
   bool virtual_keyboard_enabled_ = false;

diff --git a/ash/fast_ink/fast_ink_pointer_controller.cc b/ash/fast_ink/fast_ink_pointer_controller.cc
index 791784ec..6d8699a 100644
--- a/ash/fast_ink/fast_ink_pointer_controller.cc
+++ b/ash/fast_ink/fast_ink_pointer_controller.cc

@@ -45,13 +45,11 @@
 }
 
 void FastInkPointerController::SetEnabled(bool enabled) {
-  if (enabled == enabled_)
-    return;
-
   enabled_ = enabled;
-
-  if (!enabled_)
-    DestroyPointerView();
+  // Not calling DestroyPointerView when disabling, leaving the control over
+  // the pointer view lifetime to the specific controller implementation.
+  // For instance, a controller might prefer to keep the pointer view around
+  // while it is being animated away.
 }
 
 void FastInkPointerController::OnTouchEvent(ui::TouchEvent* event) {

diff --git a/ash/high_contrast/high_contrast_controller.h b/ash/high_contrast/high_contrast_controller.h
index ddf1e73..dc8ed1e 100644
--- a/ash/high_contrast/high_contrast_controller.h
+++ b/ash/high_contrast/high_contrast_controller.h

@@ -15,6 +15,7 @@
 
 namespace ash {
 
+// Controls the accessibility high contrast mode for classic ash.
 class ASH_EXPORT HighContrastController : public ShellObserver {
  public:
   HighContrastController();

diff --git a/ash/highlighter/highlighter_controller.cc b/ash/highlighter/highlighter_controller.cc
index a4da017..5d38fc90 100644
--- a/ash/highlighter/highlighter_controller.cc
+++ b/ash/highlighter/highlighter_controller.cc

@@ -66,6 +66,12 @@
     UMA_HISTOGRAM_COUNTS_100(
         "Ash.Shelf.Palette.Assistant.GesturesPerSession.Recognized",
         recognized_gesture_counter_);
+
+    // If |highlighter_view_| is animating it will delete itself when done
+    // animating. |result_view_| will exist only if |highlighter_view_| is
+    // animating, and it will also delete itself when done animating.
+    if (highlighter_view_ && !highlighter_view_->animating())
+      DestroyPointerView();
   }
 }
 

diff --git a/ash/highlighter/highlighter_controller_test_api.cc b/ash/highlighter/highlighter_controller_test_api.cc
index ebe2012..b7837393 100644
--- a/ash/highlighter/highlighter_controller_test_api.cc
+++ b/ash/highlighter/highlighter_controller_test_api.cc

@@ -24,13 +24,16 @@
   instance_->SetEnabled(enabled);
 }
 
+void HighlighterControllerTestApi::DestroyPointerView() {
+  instance_->DestroyPointerView();
+}
+
 bool HighlighterControllerTestApi::IsShowingHighlighter() const {
   return instance_->highlighter_view_.get();
 }
 
 bool HighlighterControllerTestApi::IsFadingAway() const {
-  return IsShowingHighlighter() &&
-         instance_->highlighter_view_->animation_timer_.get();
+  return IsShowingHighlighter() && instance_->highlighter_view_->animating();
 }
 
 bool HighlighterControllerTestApi::IsShowingSelectionResult() const {

diff --git a/ash/highlighter/highlighter_controller_test_api.h b/ash/highlighter/highlighter_controller_test_api.h
index e8966e0e..ba03dd8 100644
--- a/ash/highlighter/highlighter_controller_test_api.h
+++ b/ash/highlighter/highlighter_controller_test_api.h

@@ -23,6 +23,7 @@
   ~HighlighterControllerTestApi() override;
 
   void SetEnabled(bool enabled);
+  void DestroyPointerView();
   bool IsShowingHighlighter() const;
   bool IsFadingAway() const;
   bool IsShowingSelectionResult() const;

diff --git a/ash/highlighter/highlighter_controller_unittest.cc b/ash/highlighter/highlighter_controller_unittest.cc
index 910faab..1464743 100644
--- a/ash/highlighter/highlighter_controller_unittest.cc
+++ b/ash/highlighter/highlighter_controller_unittest.cc

@@ -95,13 +95,16 @@
   EXPECT_TRUE(controller_test_api_->IsShowingHighlighter());
   EXPECT_TRUE(controller_test_api_->IsFadingAway());
 
-  // Verify that disabling the mode does not display the highlighter pointer.
+  // Verify that disabling the mode right after the gesture completion does not
+  // hide the highlighter pointer immediately but lets it play out the
+  // animation.
   controller_test_api_->SetEnabled(false);
-  EXPECT_FALSE(controller_test_api_->IsShowingHighlighter());
-  EXPECT_FALSE(controller_test_api_->IsFadingAway());
+  EXPECT_TRUE(controller_test_api_->IsShowingHighlighter());
+  EXPECT_TRUE(controller_test_api_->IsFadingAway());
 
-  // Verify that disabling the mode while highlighter pointer is displayed does
-  // not display the highlighter pointer.
+  // Verify that disabling the mode mid-gesture hides the highlighter pointer
+  // immediately.
+  controller_test_api_->DestroyPointerView();
   controller_test_api_->SetEnabled(true);
   GetEventGenerator().PressTouch();
   GetEventGenerator().MoveTouch(gfx::Point(6, 6));

diff --git a/ash/highlighter/highlighter_view.h b/ash/highlighter/highlighter_view.h
index d44717b..4c146f0a 100644
--- a/ash/highlighter/highlighter_view.h
+++ b/ash/highlighter/highlighter_view.h

@@ -37,6 +37,8 @@
 
   const FastInkPoints& points() const { return points_; }
 
+  bool animating() const { return animation_timer_.get(); }
+
   void AddNewPoint(const gfx::PointF& new_point, const base::TimeTicks& time);
 
   void Animate(const gfx::PointF& pivot,

diff --git a/ash/laser/laser_pointer_controller.cc b/ash/laser/laser_pointer_controller.cc
index 74a20ff0..b72fc465 100644
--- a/ash/laser/laser_pointer_controller.cc
+++ b/ash/laser/laser_pointer_controller.cc

@@ -32,6 +32,12 @@
 
 LaserPointerController::~LaserPointerController() {}
 
+void LaserPointerController::SetEnabled(bool enabled) {
+  FastInkPointerController::SetEnabled(enabled);
+  if (!enabled)
+    DestroyPointerView();
+}
+
 views::View* LaserPointerController::GetPointerView() const {
   return laser_pointer_view_.get();
 }

diff --git a/ash/laser/laser_pointer_controller.h b/ash/laser/laser_pointer_controller.h
index 84dbb87..4e951f4 100644
--- a/ash/laser/laser_pointer_controller.h
+++ b/ash/laser/laser_pointer_controller.h

@@ -20,6 +20,9 @@
   LaserPointerController();
   ~LaserPointerController() override;
 
+  // FastInkPointerController:
+  void SetEnabled(bool enabled) override;
+
  private:
   friend class LaserPointerControllerTestApi;
 

diff --git a/ash/mus/BUILD.gn b/ash/mus/BUILD.gn
index 9d1ac5b..b0b4f038 100644
--- a/ash/mus/BUILD.gn
+++ b/ash/mus/BUILD.gn

@@ -18,8 +18,6 @@
     "accelerators/accelerator_controller_registrar.h",
     "accelerators/accelerator_handler.h",
     "accelerators/accelerator_ids.h",
-    "accessibility_delegate_mus.cc",
-    "accessibility_delegate_mus.h",
     "ash_window_tree_host_mus.cc",
     "ash_window_tree_host_mus.h",
     "bridge/immersive_handler_factory_mus.cc",

diff --git a/ash/mus/accessibility_delegate_mus.cc b/ash/mus/accessibility_delegate_mus.cc
deleted file mode 100644
index 186d804..0000000
--- a/ash/mus/accessibility_delegate_mus.cc
+++ /dev/null

@@ -1,31 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ash/mus/accessibility_delegate_mus.h"
-
-#include "services/service_manager/public/cpp/connector.h"
-#include "services/ui/public/interfaces/constants.mojom.h"
-
-namespace ash {
-
-AccessibilityDelegateMus::AccessibilityDelegateMus(
-    service_manager::Connector* connector)
-    : connector_(connector) {}
-
-AccessibilityDelegateMus::~AccessibilityDelegateMus() {}
-
-ui::mojom::AccessibilityManager*
-AccessibilityDelegateMus::GetAccessibilityManager() {
-  if (!accessibility_manager_ptr_.is_bound())
-    connector_->BindInterface(ui::mojom::kServiceName,
-                              &accessibility_manager_ptr_);
-  return accessibility_manager_ptr_.get();
-}
-
-void AccessibilityDelegateMus::ToggleHighContrast() {
-  DefaultAccessibilityDelegate::ToggleHighContrast();
-  GetAccessibilityManager()->SetHighContrastMode(IsHighContrastEnabled());
-}
-
-}  // namespace ash

diff --git a/ash/mus/accessibility_delegate_mus.h b/ash/mus/accessibility_delegate_mus.h
deleted file mode 100644
index 9c4bbfd6..0000000
--- a/ash/mus/accessibility_delegate_mus.h
+++ /dev/null

@@ -1,37 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef ASH_MUS_ACCESSIBILITY_DELEGATE_MUS_H_
-#define ASH_MUS_ACCESSIBILITY_DELEGATE_MUS_H_
-
-#include "ash/default_accessibility_delegate.h"
-#include "base/macros.h"
-#include "services/ui/public/interfaces/accessibility_manager.mojom.h"
-
-namespace service_manager {
-class Connector;
-}
-
-namespace ash {
-
-class AccessibilityDelegateMus : public DefaultAccessibilityDelegate {
- public:
-  explicit AccessibilityDelegateMus(service_manager::Connector* connector);
-  ~AccessibilityDelegateMus() override;
-
- private:
-  ui::mojom::AccessibilityManager* GetAccessibilityManager();
-
-  // DefaultAccessibilityDelegate:
-  void ToggleHighContrast() override;
-
-  ui::mojom::AccessibilityManagerPtr accessibility_manager_ptr_;
-  service_manager::Connector* connector_;
-
-  DISALLOW_COPY_AND_ASSIGN(AccessibilityDelegateMus);
-};
-
-}  // namespace ash
-
-#endif  // ASH_MUS_ACCESSIBILITY_DELEGATE_MUS_H_

diff --git a/ash/mus/shell_delegate_mus.cc b/ash/mus/shell_delegate_mus.cc
index 5f831c1..ec96e247 100644
--- a/ash/mus/shell_delegate_mus.cc
+++ b/ash/mus/shell_delegate_mus.cc

@@ -6,17 +6,17 @@
 
 #include <utility>
 
+#include "ash/default_accessibility_delegate.h"
 #include "ash/gpu_support_stub.h"
-#include "ash/mus/accessibility_delegate_mus.h"
 #include "ash/mus/wallpaper_delegate_mus.h"
 #include "ash/palette_delegate.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_util.h"
 #include "components/user_manager/user_info_impl.h"
+#include "services/ui/public/cpp/input_devices/input_device_controller_client.h"
 #include "ui/gfx/image/image.h"
 #include "ui/keyboard/keyboard_ui.h"
-#include "services/ui/public/cpp/input_devices/input_device_controller_client.h"
 
 namespace ash {
 
@@ -95,7 +95,7 @@
 }
 
 AccessibilityDelegate* ShellDelegateMus::CreateAccessibilityDelegate() {
-  return new AccessibilityDelegateMus(connector_);
+  return new DefaultAccessibilityDelegate;
 }
 
 std::unique_ptr<PaletteDelegate> ShellDelegateMus::CreatePaletteDelegate() {

diff --git a/ash/palette_delegate.h b/ash/palette_delegate.h
index b908aac..9401eb27 100644
--- a/ash/palette_delegate.h
+++ b/ash/palette_delegate.h

@@ -55,8 +55,9 @@
   // Cancels any active partial screenshot session.
   virtual void CancelPartialScreenshot() = 0;
 
-  // Shows the metalayer.
-  virtual void ShowMetalayer() = 0;
+  // Shows the metalayer. |done| is called when the metalayer session has
+  // finished.
+  virtual void ShowMetalayer(base::OnceClosure done) = 0;
 
   // Hides the metalayer.
   virtual void HideMetalayer() = 0;

diff --git a/ash/shell.cc b/ash/shell.cc
index 9140372c1..e64a30aa 100644
--- a/ash/shell.cc
+++ b/ash/shell.cc

@@ -902,7 +902,8 @@
   // Some delegates access ShellPort during their construction. Create them here
   // instead of the ShellPort constructor.
   accessibility_delegate_.reset(shell_delegate_->CreateAccessibilityDelegate());
-  accessibility_controller_ = base::MakeUnique<AccessibilityController>();
+  accessibility_controller_ = base::MakeUnique<AccessibilityController>(
+      shell_delegate_->GetShellConnector());
   palette_delegate_ = shell_delegate_->CreatePaletteDelegate();
   toast_manager_ = base::MakeUnique<ToastManager>();
 

diff --git a/ash/shell/shell_delegate_impl.cc b/ash/shell/shell_delegate_impl.cc
index 7e26474de..78d5d95 100644
--- a/ash/shell/shell_delegate_impl.cc
+++ b/ash/shell/shell_delegate_impl.cc

@@ -50,7 +50,7 @@
       done.Run();
   }
   void CancelPartialScreenshot() override {}
-  void ShowMetalayer() override {}
+  void ShowMetalayer(base::OnceClosure done) override {}
   void HideMetalayer() override {}
 
  private:

diff --git a/ash/system/bluetooth/bluetooth_power_controller.cc b/ash/system/bluetooth/bluetooth_power_controller.cc
index cf351ffb..8a4a57f9 100644
--- a/ash/system/bluetooth/bluetooth_power_controller.cc
+++ b/ash/system/bluetooth/bluetooth_power_controller.cc

@@ -113,7 +113,7 @@
   bluetooth_adapter_ = std::move(adapter);
   bluetooth_adapter_->AddObserver(this);
   if (bluetooth_adapter_->IsPresent()) {
-    RunPendingBluetoothTasks(bluetooth_adapter_.get());
+    TriggerRunPendingBluetoothTasks();
   }
 }
 
@@ -161,7 +161,7 @@
     device::BluetoothAdapter* adapter,
     bool present) {
   if (present)
-    RunPendingBluetoothTasks(adapter);
+    TriggerRunPendingBluetoothTasks();
 }
 
 void BluetoothPowerController::ApplyBluetoothPrimaryUserPref() {
@@ -211,28 +211,41 @@
                      weak_ptr_factory_.GetWeakPtr(), enabled));
 }
 
-void BluetoothPowerController::SetBluetoothPowerOnAdapterReady(
-    bool enabled,
-    device::BluetoothAdapter* adapter) {
-  adapter->SetPowered(enabled, base::Bind(&base::DoNothing),
-                      base::Bind(&base::DoNothing));
+void BluetoothPowerController::SetBluetoothPowerOnAdapterReady(bool enabled) {
+  // Always run the next pending task after SetPowered completes regardless
+  // the error.
+  bluetooth_adapter_->SetPowered(
+      enabled,
+      base::Bind(&BluetoothPowerController::RunNextPendingBluetoothTask,
+                 weak_ptr_factory_.GetWeakPtr()),
+      base::Bind(&BluetoothPowerController::RunNextPendingBluetoothTask,
+                 weak_ptr_factory_.GetWeakPtr()));
 }
 
 void BluetoothPowerController::RunBluetoothTaskWhenAdapterReady(
-    base::OnceCallback<void(device::BluetoothAdapter*)> task) {
-  if (bluetooth_adapter_ && bluetooth_adapter_->IsPresent()) {
-    std::move(task).Run(bluetooth_adapter_.get());
-  } else {
-    pending_bluetooth_tasks_.push_back(std::move(task));
-  }
+    BluetoothTask task) {
+  pending_bluetooth_tasks_.push(std::move(task));
+  TriggerRunPendingBluetoothTasks();
 }
 
-void BluetoothPowerController::RunPendingBluetoothTasks(
-    device::BluetoothAdapter* adapter) {
-  for (auto& task : pending_bluetooth_tasks_) {
-    std::move(task).Run(adapter);
+void BluetoothPowerController::TriggerRunPendingBluetoothTasks() {
+  if (pending_tasks_busy_)
+    return;
+  pending_tasks_busy_ = true;
+  RunNextPendingBluetoothTask();
+}
+
+void BluetoothPowerController::RunNextPendingBluetoothTask() {
+  if (!bluetooth_adapter_ || !bluetooth_adapter_->IsPresent() ||
+      pending_bluetooth_tasks_.empty()) {
+    // Stop running pending tasks if either adapter becomes not present or
+    // all the pending tasks have been run.
+    pending_tasks_busy_ = false;
+    return;
   }
-  pending_bluetooth_tasks_.clear();
+  BluetoothTask task = std::move(pending_bluetooth_tasks_.front());
+  pending_bluetooth_tasks_.pop();
+  std::move(task).Run();
 }
 
 void BluetoothPowerController::SavePrefValue(PrefService* prefs,
@@ -244,9 +257,9 @@
 
 void BluetoothPowerController::SavePrefValueOnAdapterReady(
     PrefService* prefs,
-    const char* pref_name,
-    device::BluetoothAdapter* adapter) {
-  prefs->SetBoolean(pref_name, adapter->IsPowered());
+    const char* pref_name) {
+  prefs->SetBoolean(pref_name, bluetooth_adapter_->IsPowered());
+  RunNextPendingBluetoothTask();
 }
 
 bool BluetoothPowerController::ShouldApplyUserBluetoothSetting(

diff --git a/ash/system/bluetooth/bluetooth_power_controller.h b/ash/system/bluetooth/bluetooth_power_controller.h
index f97d0613..a702a9f3 100644
--- a/ash/system/bluetooth/bluetooth_power_controller.h
+++ b/ash/system/bluetooth/bluetooth_power_controller.h

@@ -8,6 +8,7 @@
 #include "ash/ash_export.h"
 #include "ash/session/session_observer.h"
 #include "ash/shell_observer.h"
+#include "base/containers/queue.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "components/prefs/pref_change_registrar.h"
@@ -84,16 +85,22 @@
   void SetBluetoothPower(bool enabled);
 
   // Sets the bluetooth power given the ready adapter.
-  void SetBluetoothPowerOnAdapterReady(bool enabled,
-                                       device::BluetoothAdapter* adapter);
+  void SetBluetoothPowerOnAdapterReady(bool enabled);
+
+  using BluetoothTask = base::OnceClosure;
 
   // If adapter is ready run the task right now, otherwise add the task
   // to the queue which will be executed when bluetooth adapter is ready.
-  void RunBluetoothTaskWhenAdapterReady(
-      base::OnceCallback<void(device::BluetoothAdapter*)> task);
+  void RunBluetoothTaskWhenAdapterReady(BluetoothTask task);
 
-  // Runs all pending bluetooth adapter-dependent tasks.
-  void RunPendingBluetoothTasks(device::BluetoothAdapter* adapter);
+  // Triggers running all pending bluetooth adapter-dependent tasks.
+  void TriggerRunPendingBluetoothTasks();
+
+  // Runs the next pending bluetooth task. This will trigger another
+  // RunNextPendingBluetoothTask when the current task is finished. It will stop
+  // executing the next task when the adapter becomes not present or the queue
+  // has been empty.
+  void RunNextPendingBluetoothTask();
 
   // Sets the pref value based on current bluetooth power state. May defer
   // the operation if bluetooth adapter is not ready yet.
@@ -101,9 +108,7 @@
 
   // Sets the pref value based on current bluetooth power state, given the ready
   // bluetooth adapter.
-  void SavePrefValueOnAdapterReady(PrefService* prefs,
-                                   const char* pref_name,
-                                   device::BluetoothAdapter* adapter);
+  void SavePrefValueOnAdapterReady(PrefService* prefs, const char* pref_name);
 
   // Decides whether to apply bluetooth setting based on user type.
   // Returns true if the user type represents a human individual, currently this
@@ -123,8 +128,7 @@
 
   // Contains pending tasks which depend on the availability of bluetooth
   // adapter.
-  std::vector<base::OnceCallback<void(device::BluetoothAdapter*)>>
-      pending_bluetooth_tasks_;
+  base::queue<BluetoothTask> pending_bluetooth_tasks_;
 
   // The registrar used to watch prefs changes in the above
   // |active_user_pref_service_| from outside ash.
@@ -133,6 +137,10 @@
   std::unique_ptr<PrefChangeRegistrar> active_user_pref_change_registrar_;
   std::unique_ptr<PrefChangeRegistrar> local_state_pref_change_registrar_;
 
+  // True indicates that pending_bluetooth_tasks_ is being executed and
+  // waiting for complete callback.
+  bool pending_tasks_busy_ = false;
+
   scoped_refptr<device::BluetoothAdapter> bluetooth_adapter_;
 
   base::WeakPtrFactory<BluetoothPowerController> weak_ptr_factory_;

diff --git a/ash/system/palette/palette_tray_unittest.cc b/ash/system/palette/palette_tray_unittest.cc
index 868f386..b466817 100644
--- a/ash/system/palette/palette_tray_unittest.cc
+++ b/ash/system/palette/palette_tray_unittest.cc

@@ -248,9 +248,7 @@
   EXPECT_TRUE(highlighter_test_api.IsShowingHighlighter());
   generator.ReleaseTouch();
 
-  // Disable/enable the palette tool to hide the highlighter.
-  test_api_->GetPaletteToolManager()->DeactivateTool(PaletteToolId::METALAYER);
-  test_api_->GetPaletteToolManager()->ActivateTool(PaletteToolId::METALAYER);
+  highlighter_test_api.DestroyPointerView();
   EXPECT_FALSE(highlighter_test_api.IsShowingHighlighter());
 
   // Press/drag over the palette button. This should not activate the
@@ -399,6 +397,8 @@
   Shell::Get()->NotifyVoiceInteractionContextEnabled(false);
   EXPECT_FALSE(test_api_->GetPaletteToolManager()->IsToolActive(
       PaletteToolId::METALAYER));
+
+  highlighter_test_api.DestroyPointerView();
   EXPECT_FALSE(highlighter_test_api.IsShowingHighlighter());
 
   // Press/drag with the stylus button down should activate neither the palette

diff --git a/ash/system/palette/test_palette_delegate.cc b/ash/system/palette/test_palette_delegate.cc
index 43d0d40..aeceaca 100644
--- a/ash/system/palette/test_palette_delegate.cc
+++ b/ash/system/palette/test_palette_delegate.cc

@@ -47,7 +47,8 @@
 
 void TestPaletteDelegate::CancelPartialScreenshot() {}
 
-void TestPaletteDelegate::ShowMetalayer() {
+void TestPaletteDelegate::ShowMetalayer(base::OnceClosure done) {
+  metalayer_done_ = std::move(done);
   ++show_metalayer_count_;
   if (highlighter_test_api_)
     highlighter_test_api_->SetEnabled(true);

diff --git a/ash/system/palette/test_palette_delegate.h b/ash/system/palette/test_palette_delegate.h
index 65fe806..c46f0af 100644
--- a/ash/system/palette/test_palette_delegate.h
+++ b/ash/system/palette/test_palette_delegate.h

@@ -46,6 +46,8 @@
 
   int hide_metalayer_count() const { return hide_metalayer_count_; }
 
+  void CallMetalayerDone() { std::move(metalayer_done_).Run(); }
+
   void set_highlighter_test_api(HighlighterControllerTestApi* api) {
     highlighter_test_api_ = api;
   }
@@ -61,7 +63,7 @@
   void TakeScreenshot() override;
   void TakePartialScreenshot(const base::Closure& done) override;
   void CancelPartialScreenshot() override;
-  void ShowMetalayer() override;
+  void ShowMetalayer(base::OnceClosure done) override;
   void HideMetalayer() override;
 
   int create_note_count_ = 0;
@@ -72,9 +74,9 @@
   bool has_note_app_ = false;
   bool should_auto_open_palette_ = false;
   bool should_show_palette_ = false;
-  bool is_metalayer_supported_ = false;
   int show_metalayer_count_ = 0;
   int hide_metalayer_count_ = 0;
+  base::OnceClosure metalayer_done_;
 
   HighlighterControllerTestApi* highlighter_test_api_ = nullptr;
 

diff --git a/ash/system/palette/tools/metalayer_mode.cc b/ash/system/palette/tools/metalayer_mode.cc
index 53645ea..0a5aa5f4 100644
--- a/ash/system/palette/tools/metalayer_mode.cc
+++ b/ash/system/palette/tools/metalayer_mode.cc

@@ -30,7 +30,8 @@
 
 }  // namespace
 
-MetalayerMode::MetalayerMode(Delegate* delegate) : CommonPaletteTool(delegate) {
+MetalayerMode::MetalayerMode(Delegate* delegate)
+    : CommonPaletteTool(delegate), weak_factory_(this) {
   Shell::Get()->AddPreTargetHandler(this);
   Shell::Get()->AddShellObserver(this);
 }
@@ -51,7 +52,8 @@
 void MetalayerMode::OnEnable() {
   CommonPaletteTool::OnEnable();
 
-  Shell::Get()->palette_delegate()->ShowMetalayer();
+  Shell::Get()->palette_delegate()->ShowMetalayer(base::BindOnce(
+      &MetalayerMode::OnMetalayerSessionComplete, weak_factory_.GetWeakPtr()));
   delegate()->HidePalette();
 }
 
@@ -161,4 +163,8 @@
       CreateVectorIcon(GetPaletteIcon(), kMenuIconSize, style.GetIconColor()));
 }
 
+void MetalayerMode::OnMetalayerSessionComplete() {
+  delegate()->DisableTool(GetToolId());
+}
+
 }  // namespace ash

diff --git a/ash/system/palette/tools/metalayer_mode.h b/ash/system/palette/tools/metalayer_mode.h
index 1d92774..abd1ccd 100644
--- a/ash/system/palette/tools/metalayer_mode.h
+++ b/ash/system/palette/tools/metalayer_mode.h

@@ -9,6 +9,7 @@
 #include "ash/public/cpp/voice_interaction_state.h"
 #include "ash/shell_observer.h"
 #include "ash/system/palette/common_palette_tool.h"
+#include "base/memory/weak_ptr.h"
 #include "ui/events/event_handler.h"
 
 namespace ash {
@@ -72,6 +73,9 @@
   // Update the palette menu item based on the current availability of the tool.
   void UpdateView();
 
+  // Called when the metalayer session is complete.
+  void OnMetalayerSessionComplete();
+
   ash::VoiceInteractionState voice_interaction_state_ =
       ash::VoiceInteractionState::NOT_READY;
 
@@ -79,6 +83,8 @@
 
   bool voice_interaction_context_enabled_ = false;
 
+  base::WeakPtrFactory<MetalayerMode> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(MetalayerMode);
 };
 

diff --git a/ash/system/palette/tools/metalayer_unittest.cc b/ash/system/palette/tools/metalayer_unittest.cc
index 1365eca..a5b89d7 100644
--- a/ash/system/palette/tools/metalayer_unittest.cc
+++ b/ash/system/palette/tools/metalayer_unittest.cc

@@ -156,4 +156,13 @@
   testing::Mock::VerifyAndClearExpectations(palette_tool_delegate_.get());
 }
 
+// Verifies that invoking the callback passed to the delegate disables the tool.
+TEST_F(MetalayerToolTest, MetalayerCallbackDisablesPaletteTool) {
+  tool_->OnEnable();
+  // Calling the associated callback |metalayer_done| will disable the tool.
+  EXPECT_CALL(*palette_tool_delegate_.get(),
+              DisableTool(PaletteToolId::METALAYER));
+  test_palette_delegate()->CallMetalayerDone();
+}
+
 }  // namespace ash

diff --git a/ash/system/tray_accessibility.cc b/ash/system/tray_accessibility.cc
index 1740a3a..910f282 100644
--- a/ash/system/tray_accessibility.cc
+++ b/ash/system/tray_accessibility.cc

@@ -63,7 +63,7 @@
   uint32_t state = A11Y_NONE;
   if (delegate->IsSpokenFeedbackEnabled())
     state |= A11Y_SPOKEN_FEEDBACK;
-  if (delegate->IsHighContrastEnabled())
+  if (controller->IsHighContrastEnabled())
     state |= A11Y_HIGH_CONTRAST;
   if (delegate->IsMagnifierEnabled())
     state |= A11Y_SCREEN_MAGNIFIER;
@@ -164,7 +164,7 @@
           IDS_ASH_STATUS_TRAY_ACCESSIBILITY_SPOKEN_FEEDBACK),
       spoken_feedback_enabled_);
 
-  high_contrast_enabled_ = delegate->IsHighContrastEnabled();
+  high_contrast_enabled_ = controller->IsHighContrastEnabled();
   high_contrast_view_ = AddScrollListCheckableItem(
       kSystemMenuAccessibilityContrastIcon,
       l10n_util::GetStringUTF16(
@@ -251,10 +251,11 @@
                      : UserMetricsAction("StatusArea_SpokenFeedbackEnabled"));
     delegate->ToggleSpokenFeedback(A11Y_NOTIFICATION_NONE);
   } else if (view == high_contrast_view_) {
-    RecordAction(delegate->IsHighContrastEnabled()
-                     ? UserMetricsAction("StatusArea_HighContrastDisabled")
-                     : UserMetricsAction("StatusArea_HighContrastEnabled"));
-    delegate->ToggleHighContrast();
+    bool new_state = !controller->IsHighContrastEnabled();
+    RecordAction(new_state
+                     ? UserMetricsAction("StatusArea_HighContrastEnabled")
+                     : UserMetricsAction("StatusArea_HighContrastDisabled"));
+    controller->SetHighContrastEnabled(new_state);
   } else if (view == screen_magnifier_view_) {
     RecordAction(delegate->IsMagnifierEnabled()
                      ? UserMetricsAction("StatusArea_MagnifierDisabled")

diff --git a/ash/test/ash_test_helper.cc b/ash/test/ash_test_helper.cc
index a54bfdd..4e598483 100644
--- a/ash/test/ash_test_helper.cc
+++ b/ash/test/ash_test_helper.cc

@@ -250,6 +250,8 @@
 
   command_line_.reset();
 
+  display::Display::ResetForceDeviceScaleFactorForTesting();
+
   // WindowManager owns the CaptureController for mus/mash.
   CHECK(config_ != Config::CLASSIC || !::wm::CaptureController::Get());
 }

diff --git a/ash/wm/tablet_mode/tablet_mode_backdrop_delegate_impl.cc b/ash/wm/tablet_mode/tablet_mode_backdrop_delegate_impl.cc
index f268763..0711d67 100644
--- a/ash/wm/tablet_mode/tablet_mode_backdrop_delegate_impl.cc
+++ b/ash/wm/tablet_mode/tablet_mode_backdrop_delegate_impl.cc

@@ -3,14 +3,46 @@
 // found in the LICENSE file.
 
 #include "ash/wm/tablet_mode/tablet_mode_backdrop_delegate_impl.h"
+#include "ash/shell.h"
+#include "ash/wm/splitview/split_view_controller.h"
+#include "ash/wm/window_util.h"
 
 namespace ash {
 
+namespace {
+
+// returns true if window |upper| is stacked above window |lower| in the window
+// stacking order.
+bool IsWindowAbove(aura::Window* upper, aura::Window* lower) {
+  if (!upper || !lower || upper == lower || upper->parent() != lower->parent())
+    return false;
+
+  const aura::Window::Windows windows = upper->parent()->children();
+  auto upper_i = std::find(windows.begin(), windows.end(), upper);
+  auto lower_i = std::find(windows.begin(), windows.end(), lower);
+  return upper_i > lower_i;
+}
+
+}  // namespace
+
 TabletModeBackdropDelegateImpl::TabletModeBackdropDelegateImpl() = default;
 
 TabletModeBackdropDelegateImpl::~TabletModeBackdropDelegateImpl() = default;
 
 bool TabletModeBackdropDelegateImpl::HasBackdrop(aura::Window* window) {
+  if (!Shell::Get()->IsSplitViewModeActive())
+    return true;
+
+  // If the split view mode is active, we should place the backdrop below the
+  // snapped window whose window stacking order is lower.
+  SplitViewController* split_view_controller =
+      Shell::Get()->split_view_controller();
+  aura::Window* left_window = split_view_controller->left_window();
+  aura::Window* right_window = split_view_controller->right_window();
+  if (window == left_window && IsWindowAbove(window, right_window))
+    return false;
+  if (window == right_window && IsWindowAbove(window, left_window))
+    return false;
   return true;
 }
 

diff --git a/ash/wm/workspace/backdrop_controller.cc b/ash/wm/workspace/backdrop_controller.cc
index dc67c31..39dff7b 100644
--- a/ash/wm/workspace/backdrop_controller.cc
+++ b/ash/wm/workspace/backdrop_controller.cc

@@ -144,14 +144,6 @@
   RemoveForceHidden();
 }
 
-void BackdropController::OnSplitViewModeStarting() {
-  AddForceHidden();
-}
-
-void BackdropController::OnSplitViewModeEnded() {
-  RemoveForceHidden();
-}
-
 void BackdropController::OnAppListVisibilityChanged(bool shown,
                                                     aura::Window* root_window) {
   // Ignore the notification if it is not for this display.
@@ -215,16 +207,6 @@
 }
 
 aura::Window* BackdropController::GetTopmostWindowWithBackdrop() {
-  // ARC app should always have a backdrop when spoken feedback is enabled.
-  if (Shell::Get()->accessibility_delegate()->IsSpokenFeedbackEnabled()) {
-    aura::Window* active_window = wm::GetActiveWindow();
-    if (active_window && active_window->parent() == container_ &&
-        active_window->GetProperty(aura::client::kAppType) ==
-            static_cast<int>(AppType::ARC_APP)) {
-      return active_window;
-    }
-  }
-
   const aura::Window::Windows windows = container_->children();
   for (auto window_iter = windows.rbegin(); window_iter != windows.rend();
        ++window_iter) {
@@ -243,6 +225,16 @@
       window->GetProperty(aura::client::kHasBackdrop)) {
     return true;
   }
+
+  // If |window| is the current active window and is an ARC app window, |window|
+  // should have a backdrop when spoken feedback is enabled.
+  if (window->GetProperty(aura::client::kAppType) ==
+          static_cast<int>(AppType::ARC_APP) &&
+      wm::IsActiveWindow(window) &&
+      Shell::Get()->accessibility_delegate()->IsSpokenFeedbackEnabled()) {
+    return true;
+  }
+
   return delegate_ ? delegate_->HasBackdrop(window) : false;
 }
 

diff --git a/ash/wm/workspace/backdrop_controller.h b/ash/wm/workspace/backdrop_controller.h
index 1324842..3db0da4 100644
--- a/ash/wm/workspace/backdrop_controller.h
+++ b/ash/wm/workspace/backdrop_controller.h

@@ -60,8 +60,6 @@
   // ShellObserver:
   void OnOverviewModeStarting() override;
   void OnOverviewModeEnded() override;
-  void OnSplitViewModeStarting() override;
-  void OnSplitViewModeEnded() override;
   void OnAppListVisibilityChanged(bool shown,
                                   aura::Window* root_window) override;
 

diff --git a/ash/wm/workspace/workspace_layout_manager_unittest.cc b/ash/wm/workspace/workspace_layout_manager_unittest.cc
index 3aca3114..00477e4 100644
--- a/ash/wm/workspace/workspace_layout_manager_unittest.cc
+++ b/ash/wm/workspace/workspace_layout_manager_unittest.cc

@@ -9,6 +9,7 @@
 
 #include "ash/accessibility_delegate.h"
 #include "ash/app_list/test_app_list_presenter_impl.h"
+#include "ash/ash_switches.h"
 #include "ash/frame/custom_frame_view_ash.h"
 #include "ash/public/cpp/app_types.h"
 #include "ash/public/cpp/config.h"
@@ -28,7 +29,9 @@
 #include "ash/test/test_accessibility_delegate.h"
 #include "ash/wm/fullscreen_window_finder.h"
 #include "ash/wm/overview/window_selector_controller.h"
+#include "ash/wm/splitview/split_view_controller.h"
 #include "ash/wm/tablet_mode/tablet_mode_backdrop_delegate_impl.h"
+#include "ash/wm/tablet_mode/tablet_mode_controller.h"
 #include "ash/wm/window_state.h"
 #include "ash/wm/window_util.h"
 #include "ash/wm/wm_event.h"
@@ -1655,4 +1658,67 @@
   EXPECT_EQ(keyboard_bounds(), window->bounds());
 }
 
+// Test that backdrop works in split view mode.
+TEST_F(WorkspaceLayoutManagerBackdropTest, BackdropForSplitScreenTest) {
+  base::CommandLine::ForCurrentProcess()->AppendSwitch(
+      switches::kAshEnableTabletSplitView);
+  ShowTopWindowBackdropForContainer(default_container(), true);
+  Shell::Get()->tablet_mode_controller()->EnableTabletModeWindowManager(true);
+
+  SplitViewController* split_view_controller =
+      Shell::Get()->split_view_controller();
+
+  const gfx::Rect bounds(0, 0, 400, 400);
+  std::unique_ptr<aura::Window> window1(CreateTestWindow(bounds));
+  window1->Show();
+
+  // Test that backdrop window is visible and is the second child in the
+  // container. Its bounds should be the same as the container bounds.
+  ASSERT_EQ(2U, default_container()->children().size());
+  EXPECT_TRUE(default_container()->children()[0]->IsVisible());
+  EXPECT_TRUE(default_container()->children()[1]->IsVisible());
+  EXPECT_EQ(window1.get(), default_container()->children()[1]);
+  EXPECT_EQ(default_container()->bounds(),
+            default_container()->children()[0]->bounds());
+
+  // Snap the window to left. Test that the backdrop window is still visible
+  // and is the second child in the container. Its bounds should still be the
+  // same as the container bounds.
+  split_view_controller->SnapWindow(window1.get(), SplitViewController::LEFT);
+  ASSERT_EQ(2U, default_container()->children().size());
+  EXPECT_TRUE(default_container()->children()[0]->IsVisible());
+  EXPECT_TRUE(default_container()->children()[1]->IsVisible());
+  EXPECT_EQ(window1.get(), default_container()->children()[1]);
+  EXPECT_EQ(default_container()->bounds(),
+            default_container()->children()[0]->bounds());
+
+  // Now snap another window to right. Test that the backdrop window is still
+  // visible but is now the third window in the container. Its bounds should
+  // still be the same as the container bounds.
+  std::unique_ptr<aura::Window> window2(CreateTestWindow(bounds));
+  split_view_controller->SnapWindow(window2.get(), SplitViewController::RIGHT);
+
+  ASSERT_EQ(3U, default_container()->children().size());
+  EXPECT_TRUE(default_container()->children()[0]->IsVisible());
+  EXPECT_TRUE(default_container()->children()[1]->IsVisible());
+  EXPECT_TRUE(default_container()->children()[2]->IsVisible());
+  EXPECT_EQ(window1.get(), default_container()->children()[1]);
+  EXPECT_EQ(window2.get(), default_container()->children()[2]);
+  EXPECT_EQ(default_container()->bounds(),
+            default_container()->children()[0]->bounds());
+
+  // Test activation change correctly updates the backdrop.
+  wm::ActivateWindow(window1.get());
+  EXPECT_EQ(window1.get(), default_container()->children()[2]);
+  EXPECT_EQ(window2.get(), default_container()->children()[1]);
+  EXPECT_EQ(default_container()->bounds(),
+            default_container()->children()[0]->bounds());
+
+  wm::ActivateWindow(window2.get());
+  EXPECT_EQ(window1.get(), default_container()->children()[1]);
+  EXPECT_EQ(window2.get(), default_container()->children()[2]);
+  EXPECT_EQ(default_container()->bounds(),
+            default_container()->children()[0]->bounds());
+}
+
 }  // namespace ash

diff --git a/base/BUILD.gn b/base/BUILD.gn
index 19c9512a..d1410d4 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn

@@ -39,6 +39,11 @@
 
   # Partition alloc is included by default except iOS.
   use_partition_alloc = !is_ios
+
+  # Indicates if the Location object contains the source code information
+  # (file, function, line). False means only the program counter (and currently
+  # file name) is saved.
+  enable_location_source = true
 }
 
 if (is_android) {
@@ -1681,6 +1686,7 @@
   header = "debugging_flags.h"
   header_dir = "base/debug"
   flags = [
+    "ENABLE_LOCATION_SOURCE=$enable_location_source",
     "ENABLE_PROFILING=$enable_profiling",
     "CAN_UNWIND_WITH_FRAME_POINTERS=$can_unwind_with_frame_pointers",
   ]

diff --git a/base/hash.cc b/base/hash.cc
index 2f018259..4af0862 100644
--- a/base/hash.cc
+++ b/base/hash.cc

@@ -11,12 +11,34 @@
 
 namespace base {
 
-uint32_t SuperFastHash(const char* data, size_t length) {
+uint32_t Hash(const void* data, size_t length) {
+  // Currently our in-memory hash is the same as the persistent hash. The
+  // split between in-memory and persistent hash functions is maintained to
+  // allow the in-memory hash function to be updated in the future.
+  return PersistentHash(data, length);
+}
+
+uint32_t Hash(const std::string& str) {
+  return PersistentHash(str.data(), str.size());
+}
+
+uint32_t Hash(const string16& str) {
+  return PersistentHash(str.data(), str.size() * sizeof(char16));
+}
+
+uint32_t PersistentHash(const void* data, size_t length) {
+  // This hash function must not change, since it is designed to be persistable
+  // to disk.
   if (length > static_cast<size_t>(std::numeric_limits<int>::max())) {
     NOTREACHED();
     return 0;
   }
-  return ::SuperFastHash(data, static_cast<int>(length));
+  return ::SuperFastHash(reinterpret_cast<const char*>(data),
+                         static_cast<int>(length));
+}
+
+uint32_t PersistentHash(const std::string& str) {
+  return PersistentHash(str.data(), str.size());
 }
 
 }  // namespace base

diff --git a/base/hash.h b/base/hash.h
index 7c0fba6..e7771ef 100644
--- a/base/hash.h
+++ b/base/hash.h

@@ -14,23 +14,27 @@
 
 #include "base/base_export.h"
 #include "base/logging.h"
+#include "base/strings/string16.h"
 
 namespace base {
 
+// Computes a hash of a memory buffer. This hash function is subject to change
+// in the future, so use only for temporary in-memory structures. If you need
+// to persist a change on disk or between computers, use PersistentHash().
+//
 // WARNING: This hash function should not be used for any cryptographic purpose.
-BASE_EXPORT uint32_t SuperFastHash(const char* data, size_t length);
+BASE_EXPORT uint32_t Hash(const void* data, size_t length);
+BASE_EXPORT uint32_t Hash(const std::string& str);
+BASE_EXPORT uint32_t Hash(const string16& str);
 
-// Computes a hash of a memory buffer |data| of a given |length|.
+// Computes a hash of a memory buffer. This hash function must not change so
+// that code can use the hashed values for persistent storage purposes or
+// sending across the network. If a new persistent hash function is desired, a
+// new version will have to be added in addition.
+//
 // WARNING: This hash function should not be used for any cryptographic purpose.
-inline uint32_t Hash(const char* data, size_t length) {
-  return SuperFastHash(data, length);
-}
-
-// Computes a hash of a string |str|.
-// WARNING: This hash function should not be used for any cryptographic purpose.
-inline uint32_t Hash(const std::string& str) {
-  return Hash(str.data(), str.size());
-}
+BASE_EXPORT uint32_t PersistentHash(const void* data, size_t length);
+BASE_EXPORT uint32_t PersistentHash(const std::string& str);
 
 // Implement hashing for pairs of at-most 32 bit integer values.
 // When size_t is 32 bits, we turn the 64-bit hash code into 32 bits by using

diff --git a/base/location.cc b/base/location.cc
index 1333e6e..b139844 100644
--- a/base/location.cc
+++ b/base/location.cc

@@ -14,6 +14,12 @@
 
 namespace tracked_objects {
 
+Location::Location() = default;
+Location::Location(const Location& other) = default;
+
+Location::Location(const char* file_name, const void* program_counter)
+    : file_name_(file_name), program_counter_(program_counter) {}
+
 Location::Location(const char* function_name,
                    const char* file_name,
                    int line_number,
@@ -22,72 +28,54 @@
       file_name_(file_name),
       line_number_(line_number),
       program_counter_(program_counter) {
-}
-
-Location::Location()
-    : function_name_("Unknown"),
-      file_name_("Unknown"),
-      line_number_(-1),
-      program_counter_(NULL) {
-}
-
-Location::Location(const Location& other)
-    : function_name_(other.function_name_),
-      file_name_(other.file_name_),
-      line_number_(other.line_number_),
-      program_counter_(other.program_counter_) {
+#if !defined(OS_NACL)
+  // The program counter should not be null except in a default constructed
+  // (empty) Location object. This value is used for identity, so if it doesn't
+  // uniquely identify a location, things will break.
+  //
+  // The program counter isn't supported in NaCl so location objects won't work
+  // properly in that context.
+  DCHECK(program_counter);
+#endif
 }
 
 std::string Location::ToString() const {
-  return std::string(function_name_) + "@" + file_name_ + ":" +
-      base::IntToString(line_number_);
+  if (has_source_info()) {
+    return std::string(function_name_) + "@" + file_name_ + ":" +
+           base::IntToString(line_number_);
+  }
+  return base::StringPrintf("pc:%p", program_counter_);
 }
 
+// TODO(brettw) if chrome://profiler is removed, this function can probably
+// be removed or merged with ToString.
 void Location::Write(bool display_filename, bool display_function_name,
                      std::string* output) const {
-  base::StringAppendF(output, "%s[%d] ",
-      display_filename ? file_name_ : "line",
-      line_number_);
+  if (has_source_info()) {
+    base::StringAppendF(output, "%s[%d] ",
+                        display_filename && file_name_ ? file_name_ : "line",
+                        line_number_);
 
-  if (display_function_name) {
-    WriteFunctionName(output);
-    output->push_back(' ');
-  }
-}
-
-void Location::WriteFunctionName(std::string* output) const {
-  // Translate "<" to "&lt;" for HTML safety.
-  // TODO(jar): Support ASCII or html for logging in ASCII.
-  for (const char *p = function_name_; *p; p++) {
-    switch (*p) {
-      case '<':
-        output->append("&lt;");
-        break;
-
-      case '>':
-        output->append("&gt;");
-        break;
-
-      default:
-        output->push_back(*p);
-        break;
+    if (display_function_name && function_name_) {
+      output->append(function_name_);
+      output->push_back(' ');
     }
+  } else {
+    *output = ToString();
   }
 }
 
-//------------------------------------------------------------------------------
-LocationSnapshot::LocationSnapshot() : line_number(-1) {
+LocationSnapshot::LocationSnapshot() = default;
+
+LocationSnapshot::LocationSnapshot(const Location& location)
+    : line_number(location.line_number()) {
+  if (location.file_name())
+    file_name = location.file_name();
+  if (location.function_name())
+    function_name = location.function_name();
 }
 
-LocationSnapshot::LocationSnapshot(
-    const tracked_objects::Location& location)
-    : file_name(location.file_name()),
-      function_name(location.function_name()),
-      line_number(location.line_number()) {
-}
-
-LocationSnapshot::~LocationSnapshot() {
-}
+LocationSnapshot::~LocationSnapshot() = default;
 
 //------------------------------------------------------------------------------
 #if defined(COMPILER_MSVC)
@@ -99,7 +87,7 @@
 #elif defined(COMPILER_GCC) && !defined(OS_NACL)
   return __builtin_extract_return_addr(__builtin_return_address(0));
 #else
-  return NULL;
+  return nullptr;
 #endif
 }
 

diff --git a/base/location.h b/base/location.h
index dd78515..f7dfd34 100644
--- a/base/location.h
+++ b/base/location.h

@@ -11,6 +11,7 @@
 #include <string>
 
 #include "base/base_export.h"
+#include "base/debug/debugging_flags.h"
 #include "base/hash.h"
 
 namespace tracked_objects {
@@ -19,6 +20,14 @@
 // significantly brought to life.
 class BASE_EXPORT Location {
  public:
+  Location();
+  Location(const Location& other);
+
+  // Only initializes the file name and program counter, the source information
+  // will be null for the strings, and -1 for the line number.
+  // TODO(http://crbug.com/760702) remove file name from this constructor.
+  Location(const char* file_name, const void* program_counter);
+
   // Constructor should be called with a long-lived char*, such as __FILE__.
   // It assumes the provided value will persist as a global constant, and it
   // will not make a copy of it.
@@ -27,58 +36,52 @@
            int line_number,
            const void* program_counter);
 
-  // Provide a default constructor for easy of debugging.
-  Location();
-
-  // Copy constructor.
-  Location(const Location& other);
-
-  // Comparator for hash map insertion.
-  // No need to use |function_name_| since the other two fields uniquely
-  // identify this location.
+  // Comparator for hash map insertion. The program counter should uniquely
+  // identify a location.
   bool operator==(const Location& other) const {
-    return line_number_ == other.line_number_ &&
-           file_name_ == other.file_name_;
+    return program_counter_ == other.program_counter_;
   }
 
-  const char* function_name()   const { return function_name_; }
-  const char* file_name()       const { return file_name_; }
-  int line_number()             const { return line_number_; }
+  // Returns true if there is source code location info. If this is false,
+  // the Location object only contains a program counter or is
+  // default-initialized (the program counter is also null).
+  bool has_source_info() const { return function_name_ && file_name_; }
+
+  // Will be nullptr for default initialized Location objects and when source
+  // names are disabled.
+  const char* function_name() const { return function_name_; }
+
+  // Will be nullptr for default initialized Location objects and when source
+  // names are disabled.
+  const char* file_name() const { return file_name_; }
+
+  // Will be -1 for default initialized Location objects and when source names
+  // are disabled.
+  int line_number() const { return line_number_; }
+
+  // The address of the code generating this Location object. Should always be
+  // valid except for default initialized Location objects, which will be
+  // nullptr.
   const void* program_counter() const { return program_counter_; }
 
+  // See Write().
   std::string ToString() const;
 
-  // Hash operator for hash maps.
-  struct Hash {
-    size_t operator()(const Location& location) const {
-      // Compute the hash value using file name pointer and line number.
-      // No need to use |function_name_| since the other two fields uniquely
-      // identify this location.
-
-      // The file name will always be uniquely identified by its pointer since
-      // it comes from __FILE__, so no need to check the contents of the string.
-      // See the definition of FROM_HERE in location.h, and how it is used
-      // elsewhere.
-      return base::HashInts(reinterpret_cast<uintptr_t>(location.file_name()),
-                            location.line_number());
-    }
-  };
-
   // Translate the some of the state in this instance into a human readable
   // string with HTML characters in the function names escaped, and append that
-  // string to |output|.  Inclusion of the file_name_ and function_name_ are
+  // string to |output|. Inclusion of the file_name_ and function_name_ are
   // optional, and controlled by the boolean arguments.
+  //
+  // If the function and file names are null, the program counter will be
+  // written.
   void Write(bool display_filename, bool display_function_name,
              std::string* output) const;
 
-  // Write function_name_ in HTML with '<' and '>' properly encoded.
-  void WriteFunctionName(std::string* output) const;
-
  private:
-  const char* function_name_;
-  const char* file_name_;
-  int line_number_;
-  const void* program_counter_;
+  const char* function_name_ = nullptr;
+  const char* file_name_ = nullptr;
+  int line_number_ = -1;
+  const void* program_counter_ = nullptr;
 };
 
 // A "snapshotted" representation of the Location class that can safely be
@@ -91,20 +94,44 @@
 
   std::string file_name;
   std::string function_name;
-  int line_number;
+  int line_number = -1;
 };
 
 BASE_EXPORT const void* GetProgramCounter();
 
-// Define a macro to record the current source location.
-#define FROM_HERE FROM_HERE_WITH_EXPLICIT_FUNCTION(__func__)
+// The macros defined here will expand to the current function.
+#if BUILDFLAG(ENABLE_LOCATION_SOURCE)
 
-#define FROM_HERE_WITH_EXPLICIT_FUNCTION(function_name)                        \
-    ::tracked_objects::Location(function_name,                                 \
-                                __FILE__,                                      \
-                                __LINE__,                                      \
-                                ::tracked_objects::GetProgramCounter())
+// Full source information should be included.
+#define FROM_HERE FROM_HERE_WITH_EXPLICIT_FUNCTION(__func__)
+#define FROM_HERE_WITH_EXPLICIT_FUNCTION(function_name)          \
+  ::tracked_objects::Location(function_name, __FILE__, __LINE__, \
+                              ::tracked_objects::GetProgramCounter())
+
+#else
+
+// TODO(http://crbug.com/760702) remove the __FILE__ argument from these calls.
+#define FROM_HERE \
+  ::tracked_objects::Location(__FILE__, ::tracked_objects::GetProgramCounter())
+#define FROM_HERE_WITH_EXPLICIT_FUNCTION(function_name)    \
+  ::tracked_objects::Location(function_name, __FILE__, -1, \
+                              ::tracked_objects::GetProgramCounter())
+
+#endif
 
 }  // namespace tracked_objects
 
+namespace std {
+
+// Specialization for using Location in hash tables.
+template <>
+struct hash<::tracked_objects::Location> {
+  std::size_t operator()(const ::tracked_objects::Location& loc) const {
+    const void* program_counter = loc.program_counter();
+    return base::Hash(&program_counter, sizeof(void*));
+  }
+};
+
+}  // namespace std
+
 #endif  // BASE_LOCATION_H_

diff --git a/base/message_loop/incoming_task_queue.cc b/base/message_loop/incoming_task_queue.cc
index a945abbb..90b8f22 100644
--- a/base/message_loop/incoming_task_queue.cc
+++ b/base/message_loop/incoming_task_queue.cc

@@ -138,6 +138,11 @@
   DCHECK(!message_loop_);
 }
 
+void IncomingTaskQueue::RunTask(PendingTask* pending_task) {
+  SEQUENCE_CHECKER(sequence_checker_);
+  task_annotator_.RunTask("MessageLoop::PostTask", pending_task);
+}
+
 bool IncomingTaskQueue::PostPendingTask(PendingTask* pending_task) {
   // Warning: Don't try to short-circuit, and handle this thread's tasks more
   // directly, as it could starve handling of foreign threads.  Put every task
@@ -165,8 +170,7 @@
     // delayed_run_time value) and for identifying the task in about:tracing.
     pending_task->sequence_num = next_sequence_num_++;
 
-    message_loop_->task_annotator()->DidQueueTask("MessageLoop::PostTask",
-                                                  *pending_task);
+    task_annotator_.DidQueueTask("MessageLoop::PostTask", *pending_task);
 
     bool was_empty = incoming_queue_.empty();
     incoming_queue_.push(std::move(*pending_task));

diff --git a/base/message_loop/incoming_task_queue.h b/base/message_loop/incoming_task_queue.h
index d6028cb9..0427688 100644
--- a/base/message_loop/incoming_task_queue.h
+++ b/base/message_loop/incoming_task_queue.h

@@ -7,9 +7,11 @@
 
 #include "base/base_export.h"
 #include "base/callback.h"
+#include "base/debug/task_annotator.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/pending_task.h"
+#include "base/sequence_checker.h"
 #include "base/synchronization/lock.h"
 #include "base/synchronization/read_write_lock.h"
 #include "base/time/time.h"
@@ -55,6 +57,9 @@
   // scheduling work.
   void StartScheduling();
 
+  // Runs |pending_task|.
+  void RunTask(PendingTask* pending_task);
+
  private:
   friend class RefCountedThreadSafe<IncomingTaskQueue>;
   virtual ~IncomingTaskQueue();
@@ -68,6 +73,8 @@
   // Wakes up the message loop and schedules work.
   void ScheduleWork();
 
+  debug::TaskAnnotator task_annotator_;
+
   // Number of tasks that require high resolution timing. This value is kept
   // so that ReloadWorkQueue() completes in constant time.
   int high_res_task_count_;
@@ -102,6 +109,9 @@
   // False until StartScheduling() is called.
   bool is_ready_for_scheduling_;
 
+  // Checks calls made only on the MessageLoop thread.
+  SEQUENCE_CHECKER(sequence_checker_);
+
   DISALLOW_COPY_AND_ASSIGN(IncomingTaskQueue);
 };
 

diff --git a/base/message_loop/message_loop.cc b/base/message_loop/message_loop.cc
index 67b9e225..4aaffe0 100644
--- a/base/message_loop/message_loop.cc
+++ b/base/message_loop/message_loop.cc

@@ -403,7 +403,7 @@
 
   for (auto& observer : task_observers_)
     observer.WillProcessTask(*pending_task);
-  task_annotator_.RunTask("MessageLoop::PostTask", pending_task);
+  incoming_task_queue_->RunTask(pending_task);
   for (auto& observer : task_observers_)
     observer.DidProcessTask(*pending_task);
 

diff --git a/base/message_loop/message_loop.h b/base/message_loop/message_loop.h
index a118917e..4206b444 100644
--- a/base/message_loop/message_loop.h
+++ b/base/message_loop/message_loop.h

@@ -11,7 +11,6 @@
 
 #include "base/base_export.h"
 #include "base/callback_forward.h"
-#include "base/debug/task_annotator.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -281,10 +280,6 @@
   // Returns true if the message loop is "idle". Provided for testing.
   bool IsIdleForTesting();
 
-  // Returns the TaskAnnotator which is used to add debug information to posted
-  // tasks.
-  debug::TaskAnnotator* task_annotator() { return &task_annotator_; }
-
   // Runs the specified PendingTask.
   void RunTask(PendingTask* pending_task);
 
@@ -419,8 +414,6 @@
 
   ObserverList<TaskObserver> task_observers_;
 
-  debug::TaskAnnotator task_annotator_;
-
   // Used to allow creating a breadcrumb of program counters in PostTask.
   // This variable is only initialized while a task is being executed and is
   // meant only to store context for creating a backtrace breadcrumb. Do not

diff --git a/base/task_scheduler/task.cc b/base/task_scheduler/task.cc
index 3cf26be..18b9d0d 100644
--- a/base/task_scheduler/task.cc
+++ b/base/task_scheduler/task.cc

@@ -32,6 +32,17 @@
               : traits),
       delay(delay) {}
 
+// This should be "= default but MSVC has trouble with "noexcept = default" in
+// this case.
+Task::Task(Task&& other) noexcept
+    : PendingTask(std::move(other)),
+      traits(other.traits),
+      delay(other.delay),
+      sequenced_time(other.sequenced_time),
+      sequenced_task_runner_ref(std::move(other.sequenced_task_runner_ref)),
+      single_thread_task_runner_ref(
+          std::move(other.single_thread_task_runner_ref)) {}
+
 Task::~Task() = default;
 
 }  // namespace internal

diff --git a/base/task_scheduler/task.h b/base/task_scheduler/task.h
index 43095f2a..061bb62 100644
--- a/base/task_scheduler/task.h
+++ b/base/task_scheduler/task.h

@@ -31,6 +31,12 @@
        OnceClosure task,
        const TaskTraits& traits,
        TimeDelta delay);
+
+  // Task is move-only to avoid mistakes that cause reference counts to be
+  // accidentally bumped.
+  Task(Task&& other) noexcept;
+  Task(const Task&) = delete;
+
   ~Task();
 
   // The TaskTraits of this task.
@@ -56,11 +62,6 @@
   // support TaskRunnerHandles.
   scoped_refptr<SequencedTaskRunner> sequenced_task_runner_ref;
   scoped_refptr<SingleThreadTaskRunner> single_thread_task_runner_ref;
-
- private:
-  // Disallow copies to make sure no unnecessary ref-bumps are incurred. Making
-  // it move-only would be an option, but isn't necessary for now.
-  DISALLOW_COPY_AND_ASSIGN(Task);
 };
 
 }  // namespace internal

diff --git a/base/trace_event/heap_profiler_allocation_context.cc b/base/trace_event/heap_profiler_allocation_context.cc
index c001945..bdc3c58 100644
--- a/base/trace_event/heap_profiler_allocation_context.cc
+++ b/base/trace_event/heap_profiler_allocation_context.cc

@@ -24,7 +24,7 @@
   return !(lhs.value == rhs.value);
 }
 
-Backtrace::Backtrace(): frame_count(0) {}
+Backtrace::Backtrace() = default;
 
 bool operator==(const Backtrace& lhs, const Backtrace& rhs) {
   if (lhs.frame_count != rhs.frame_count) return false;
@@ -67,9 +67,7 @@
   for (size_t i = 0; i != backtrace.frame_count; ++i) {
     values[i] = backtrace.frames[i].value;
   }
-  return base::SuperFastHash(
-      reinterpret_cast<const char*>(values),
-      static_cast<int>(backtrace.frame_count * sizeof(*values)));
+  return base::PersistentHash(values, backtrace.frame_count * sizeof(*values));
 }
 
 size_t hash<AllocationContext>::operator()(const AllocationContext& ctx) const {

diff --git a/base/trace_event/heap_profiler_allocation_context.h b/base/trace_event/heap_profiler_allocation_context.h
index 5173eefb..c35663fb 100644
--- a/base/trace_event/heap_profiler_allocation_context.h
+++ b/base/trace_event/heap_profiler_allocation_context.h

@@ -74,7 +74,7 @@
   // pseudo traces (see above), but not for native traces, where we need more.
   enum { kMaxFrameCount = 48 };
   StackFrame frames[kMaxFrameCount];
-  size_t frame_count;
+  size_t frame_count = 0;
 };
 
 bool BASE_EXPORT operator==(const Backtrace& lhs, const Backtrace& rhs);

diff --git a/base/trace_event/memory_dump_manager.cc b/base/trace_event/memory_dump_manager.cc
index 2e409c6..cc0dac90 100644
--- a/base/trace_event/memory_dump_manager.cc
+++ b/base/trace_event/memory_dump_manager.cc

@@ -92,6 +92,11 @@
   GetterFunctPtr const getter_function;
 };
 
+inline bool IsHeapProfilingModeEnabled(HeapProfilingMode mode) {
+  return mode != kHeapProfilingModeDisabled &&
+         mode != kHeapProfilingModeInvalid;
+}
+
 }  // namespace
 
 // static
@@ -134,7 +139,7 @@
     : is_coordinator_(false),
       tracing_process_id_(kInvalidTracingProcessId),
       dumper_registrations_ignored_for_testing_(false),
-      heap_profiling_state_(HeapProfilingState::DISABLED) {
+      heap_profiling_mode_(kHeapProfilingModeDisabled) {
   // At this point the command line may not be initialized but we try to
   // enable the heap profiler to capture allocations as soon as possible.
   EnableHeapProfilingIfNeeded();
@@ -178,67 +183,104 @@
 }
 
 void MemoryDumpManager::EnableHeapProfilingIfNeeded() {
-  {
-    AutoLock lock(lock_);
-    if (heap_profiling_state_ != HeapProfilingState::DISABLED)
-      return;
-  }
+#if BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
   HeapProfilingMode profiling_mode = GetHeapProfilingModeFromCommandLine();
-  if (profiling_mode != kHeapProfilingModeDisabled &&
-      profiling_mode != kHeapProfilingModeInvalid) {
+  if (IsHeapProfilingModeEnabled(profiling_mode)) {
     EnableHeapProfiling(profiling_mode);
+  } else {
+    if (profiling_mode == kHeapProfilingModeInvalid) {
+      // Heap profiling is misconfigured, disable it permanently.
+      EnableHeapProfiling(kHeapProfilingModeDisabled);
+    }
   }
+#else
+  // Heap profiling is unsupported, disable it permanently.
+  EnableHeapProfiling(kHeapProfilingModeDisabled);
+#endif  // BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
 }
 
-void MemoryDumpManager::EnableHeapProfiling(HeapProfilingMode profiling_mode) {
-#if BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
+bool MemoryDumpManager::EnableHeapProfiling(HeapProfilingMode profiling_mode) {
   AutoLock lock(lock_);
-  // Should we not enable heap profiling if tracing is enabled, since
-  // session_state_ will not be initialized.
-  if (heap_profiling_state_ == HeapProfilingState::DISABLED_PERMANENTLY)
-    return;
+#if BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
+  bool notify_mdps = true;
 
-  if (heap_profiling_state_ == HeapProfilingState::DISABLED) {
-    switch (profiling_mode) {
-      case kHeapProfilingModePseudo:
-        AllocationContextTracker::SetCaptureMode(
-            AllocationContextTracker::CaptureMode::PSEUDO_STACK);
-        break;
-      case kHeapProfilingModeNative:
-        // If we don't have frame pointers then native tracing falls-back to
-        // using base::debug::StackTrace, which may be slow.
-        AllocationContextTracker::SetCaptureMode(
-            AllocationContextTracker::CaptureMode::NATIVE_STACK);
-        break;
-      case kHeapProfilingModeNoStack:
-        AllocationContextTracker::SetCaptureMode(
-            AllocationContextTracker::CaptureMode::NO_STACK);
-        break;
-      case kHeapProfilingModeTaskProfiler:
-        if (!base::debug::ThreadHeapUsageTracker::IsHeapTrackingEnabled())
-          base::debug::ThreadHeapUsageTracker::EnableHeapTracking();
-        return;  // Do not notify dump providers.
-      default:
-        return;  // Do not notify dump providers.
+  // TODO(kraynov, ssid): Remove this when heap profiler will be capable to
+  // get enabled when tracing had already started.
+  if (heap_profiler_serialization_state_) {
+    LOG(ERROR) << "EnableHeapProfiling can't be used when tracing is enabled.";
+    return false;
+  }
+
+  if (heap_profiling_mode_ == kHeapProfilingModeInvalid)
+    return false;  // Disabled permanently.
+
+  if (IsHeapProfilingModeEnabled(heap_profiling_mode_) ==
+      IsHeapProfilingModeEnabled(profiling_mode)) {
+    if (profiling_mode == kHeapProfilingModeDisabled)
+      heap_profiling_mode_ = kHeapProfilingModeInvalid;  // Disable permanently.
+    return false;
+  }
+
+  switch (profiling_mode) {
+    case kHeapProfilingModePseudo:
+      AllocationContextTracker::SetCaptureMode(
+          AllocationContextTracker::CaptureMode::PSEUDO_STACK);
+      break;
+
+    case kHeapProfilingModeNative:
+      // If we don't have frame pointers then native tracing falls-back to
+      // using base::debug::StackTrace, which may be slow.
+      AllocationContextTracker::SetCaptureMode(
+          AllocationContextTracker::CaptureMode::NATIVE_STACK);
+      break;
+
+    case kHeapProfilingModeNoStack:
+      AllocationContextTracker::SetCaptureMode(
+          AllocationContextTracker::CaptureMode::NO_STACK);
+      break;
+
+    case kHeapProfilingModeTaskProfiler:
+      if (!base::debug::ThreadHeapUsageTracker::IsHeapTrackingEnabled())
+        base::debug::ThreadHeapUsageTracker::EnableHeapTracking();
+      notify_mdps = false;
+      break;
+
+    case kHeapProfilingModeDisabled:
+      if (heap_profiling_mode_ == kHeapProfilingModeTaskProfiler) {
+        LOG(ERROR) << "ThreadHeapUsageTracker cannot be disabled.";
+        return false;
+      }
+      AllocationContextTracker::SetCaptureMode(
+          AllocationContextTracker::CaptureMode::DISABLED);
+      heap_profiling_mode_ = kHeapProfilingModeInvalid;  // Disable permanently.
+      break;
+
+    default:
+      NOTREACHED() << "Incorrect heap profiling mode " << profiling_mode;
+      return false;
+  }
+
+  if (heap_profiling_mode_ != kHeapProfilingModeInvalid)
+    heap_profiling_mode_ = profiling_mode;
+
+  if (notify_mdps) {
+    for (auto mdp : dump_providers_) {
+      mdp->dump_provider->OnHeapProfilingEnabled(
+          IsHeapProfilingModeEnabled(heap_profiling_mode_));
     }
-    heap_profiling_state_ = HeapProfilingState::ENABLED;
-  } else if (profiling_mode == kHeapProfilingModeDisabled) {
-    heap_profiling_state_ = HeapProfilingState::DISABLED_PERMANENTLY;
-    AllocationContextTracker::SetCaptureMode(
-        AllocationContextTracker::CaptureMode::DISABLED);
-    DCHECK(!base::debug::ThreadHeapUsageTracker::IsHeapTrackingEnabled())
-        << "ThreadHeapUsageTracker cannot be disabled";
-  } else {
-    return;
   }
-
-  for (auto mdp : dump_providers_) {
-    mdp->dump_provider->OnHeapProfilingEnabled(heap_profiling_state_ ==
-                                               HeapProfilingState::ENABLED);
-  }
+  return true;
+#else
+  heap_profiling_mode_ = kHeapProfilingModeInvalid;
+  return false;
 #endif  // BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
 }
 
+HeapProfilingMode MemoryDumpManager::GetHeapProfilingMode() {
+  AutoLock lock(lock_);
+  return heap_profiling_mode_;
+}
+
 void MemoryDumpManager::Initialize(
     RequestGlobalDumpFunction request_dump_function,
     bool is_coordinator) {
@@ -360,8 +402,7 @@
     if (options.is_fast_polling_supported)
       MemoryPeakDetector::GetInstance()->NotifyMemoryDumpProvidersChanged();
 
-    heap_profiling_enabled =
-        heap_profiling_state_ == HeapProfilingState::ENABLED;
+    heap_profiling_enabled = IsHeapProfilingModeEnabled(heap_profiling_mode_);
   }
 
   if (heap_profiling_enabled)
@@ -496,7 +537,7 @@
     // require session state so if heap profiling is on and session state is
     // absent we fail the dump immediately.
     if (args.dump_type != MemoryDumpType::SUMMARY_ONLY &&
-        heap_profiling_state_ == HeapProfilingState::ENABLED &&
+        IsHeapProfilingModeEnabled(heap_profiling_mode_) &&
         !heap_profiler_serialization_state_) {
       callback.Run(false /* success */, args.dump_guid, nullptr);
       return;
@@ -705,7 +746,7 @@
   heap_profiler_serialization_state
       ->set_heap_profiler_breakdown_threshold_bytes(
           memory_dump_config.heap_profiler_options.breakdown_threshold_bytes);
-  if (heap_profiling_state_ == HeapProfilingState::ENABLED) {
+  if (IsHeapProfilingModeEnabled(heap_profiling_mode_)) {
     // If heap profiling is enabled, the stack frame deduplicator and type name
     // deduplicator will be in use. Add a metadata events to write the frames
     // and type IDs.

diff --git a/base/trace_event/memory_dump_manager.h b/base/trace_event/memory_dump_manager.h
index 72e61ad..9512a813 100644
--- a/base/trace_event/memory_dump_manager.h
+++ b/base/trace_event/memory_dump_manager.h

@@ -41,7 +41,7 @@
   kHeapProfilingModeNative,
   kHeapProfilingModeNoStack,
   kHeapProfilingModeTaskProfiler,
-  kHeapProfilingModeInvalid
+  kHeapProfilingModeInvalid  // Disabled permanently or unsupported.
 };
 
 // This is the interface exposed to the rest of the codebase to deal with
@@ -140,10 +140,11 @@
   // is specified.
   void EnableHeapProfilingIfNeeded();
 
-  // Enable heap profiling with specified |profiling_mode|. Disabling heap
-  // profiler will disable it permanently and cannot be enabled again. Noop if
-  // heap profiling was already enabled or permanently disabled.
-  void EnableHeapProfiling(HeapProfilingMode profiling_mode);
+  // Enable heap profiling with specified |profiling_mode|.
+  // Use kHeapProfilingModeDisabled to disable, but it can't be re-enabled then.
+  // Returns true if mode has been *changed* to the desired |profiling_mode|.
+  bool EnableHeapProfiling(HeapProfilingMode profiling_mode);
+  HeapProfilingMode GetHeapProfilingMode();
 
   // Lets tests see if a dump provider is registered.
   bool IsDumpProviderRegisteredForTesting(MemoryDumpProvider*);
@@ -180,8 +181,6 @@
   friend struct DefaultSingletonTraits<MemoryDumpManager>;
   friend class MemoryDumpManagerTest;
 
-  enum class HeapProfilingState { DISABLED, ENABLED, DISABLED_PERMANENTLY };
-
   // Holds the state of a process memory dump that needs to be carried over
   // across task runners in order to fulfill an asynchronous CreateProcessDump()
   // request. At any time exactly one task runner owns a
@@ -306,10 +305,7 @@
   // When true, calling |RegisterMemoryDumpProvider| is a no-op.
   bool dumper_registrations_ignored_for_testing_;
 
-  // Heap profiling can be enabled and disabled only once in the process.
-  // New memory dump providers should be told to enable heap profiling if state
-  // is ENABLED.
-  HeapProfilingState heap_profiling_state_;
+  HeapProfilingMode heap_profiling_mode_;
 
   DISALLOW_COPY_AND_ASSIGN(MemoryDumpManager);
 };

diff --git a/base/trace_event/memory_dump_manager_unittest.cc b/base/trace_event/memory_dump_manager_unittest.cc
index 9b26754..3f3dab8 100644
--- a/base/trace_event/memory_dump_manager_unittest.cc
+++ b/base/trace_event/memory_dump_manager_unittest.cc

@@ -13,6 +13,7 @@
 #include "base/base_switches.h"
 #include "base/callback.h"
 #include "base/command_line.h"
+#include "base/debug/thread_heap_usage_tracker.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
@@ -173,6 +174,11 @@
   unsigned num_of_post_tasks_;
 };
 
+class TestingThreadHeapUsageTracker : public debug::ThreadHeapUsageTracker {
+ public:
+  using ThreadHeapUsageTracker::DisableHeapTrackingForTesting;
+};
+
 }  // namespace
 
 class MemoryDumpManagerTest : public testing::Test {
@@ -837,16 +843,21 @@
   EXPECT_CALL(mdp1, OnHeapProfilingEnabled(true)).Times(1);
   EXPECT_CALL(mdp1, OnHeapProfilingEnabled(false)).Times(1);
 
-  mdm_->EnableHeapProfiling(kHeapProfilingModePseudo);
+  EXPECT_TRUE(mdm_->EnableHeapProfiling(kHeapProfilingModePseudo));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::PSEUDO_STACK,
             AllocationContextTracker::capture_mode());
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModePseudo);
   // Disable will permanently disable heap profiling.
-  mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled);
+  EXPECT_TRUE(mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled));
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
   ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
             AllocationContextTracker::capture_mode());
-  mdm_->EnableHeapProfiling(kHeapProfilingModePseudo);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModePseudo));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
             AllocationContextTracker::capture_mode());
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled));
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
 }
 
 TEST_F(MemoryDumpManagerTest, EnableHeapProfilingNoStack) {
@@ -857,20 +868,50 @@
   EXPECT_CALL(mdp1, OnHeapProfilingEnabled(true)).Times(1);
   EXPECT_CALL(mdp1, OnHeapProfilingEnabled(false)).Times(1);
 
-  mdm_->EnableHeapProfiling(kHeapProfilingModeNoStack);
+  EXPECT_TRUE(mdm_->EnableHeapProfiling(kHeapProfilingModeNoStack));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::NO_STACK,
             AllocationContextTracker::capture_mode());
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeNoStack);
   // Do nothing when already enabled.
-  mdm_->EnableHeapProfiling(kHeapProfilingModePseudo);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModeNoStack));
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModePseudo));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::NO_STACK,
             AllocationContextTracker::capture_mode());
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeNoStack);
   // Disable will permanently disable heap profiling.
-  mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled);
+  EXPECT_TRUE(mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
             AllocationContextTracker::capture_mode());
-  mdm_->EnableHeapProfiling(kHeapProfilingModePseudo);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModePseudo));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
             AllocationContextTracker::capture_mode());
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled));
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
+}
+
+TEST_F(MemoryDumpManagerTest, EnableHeapProfilingTask) {
+  InitializeMemoryDumpManagerForInProcessTesting(true /* is_coordinator */);
+  MockMemoryDumpProvider mdp1;
+  RegisterDumpProvider(&mdp1, nullptr);
+  testing::InSequence sequence;
+  EXPECT_CALL(mdp1, OnHeapProfilingEnabled(true)).Times(0);
+  EXPECT_CALL(mdp1, OnHeapProfilingEnabled(false)).Times(0);
+
+  ASSERT_FALSE(base::debug::ThreadHeapUsageTracker::IsHeapTrackingEnabled());
+  EXPECT_TRUE(mdm_->EnableHeapProfiling(kHeapProfilingModeTaskProfiler));
+  ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
+            AllocationContextTracker::capture_mode());
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeTaskProfiler);
+  ASSERT_TRUE(debug::ThreadHeapUsageTracker::IsHeapTrackingEnabled());
+  TestingThreadHeapUsageTracker::DisableHeapTrackingForTesting();
+}
+
+TEST_F(MemoryDumpManagerTest, EnableHeapProfilingDisableDisabled) {
+  InitializeMemoryDumpManagerForInProcessTesting(true /* is_coordinator */);
+  ASSERT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeDisabled);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled));
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
 }
 #endif  //  BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
 
@@ -897,14 +938,31 @@
   mdm_->EnableHeapProfilingIfNeeded();
   ASSERT_EQ(AllocationContextTracker::CaptureMode::PSEUDO_STACK,
             AllocationContextTracker::capture_mode());
-  mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled);
+  EXPECT_TRUE(mdm_->EnableHeapProfiling(kHeapProfilingModeDisabled));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
             AllocationContextTracker::capture_mode());
-  mdm_->EnableHeapProfiling(kHeapProfilingModeNoStack);
+  EXPECT_FALSE(mdm_->EnableHeapProfiling(kHeapProfilingModeNoStack));
   ASSERT_EQ(AllocationContextTracker::CaptureMode::DISABLED,
             AllocationContextTracker::capture_mode());
 #endif  //  BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
 }
 
+TEST_F(MemoryDumpManagerTest, EnableHeapProfilingIfNeededUnsupported) {
+  InitializeMemoryDumpManagerForInProcessTesting(false /* is_coordinator */);
+
+#if BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
+  ASSERT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeDisabled);
+  CommandLine* cmdline = CommandLine::ForCurrentProcess();
+  cmdline->AppendSwitchASCII(switches::kEnableHeapProfiling, "unsupported");
+  mdm_->EnableHeapProfilingIfNeeded();
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
+#else
+  // EnableHeapProfilingIfNeeded should be called in |mdm_| constructor.
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
+  mdm_->EnableHeapProfilingIfNeeded();
+  EXPECT_EQ(mdm_->GetHeapProfilingMode(), kHeapProfilingModeInvalid);
+#endif  //  BUILDFLAG(USE_ALLOCATOR_SHIM) && !defined(OS_NACL)
+}
+
 }  // namespace trace_event
 }  // namespace base

diff --git a/base/trace_event/trace_event.h b/base/trace_event/trace_event.h
index bdabfa8..0087a01 100644
--- a/base/trace_event/trace_event.h
+++ b/base/trace_event/trace_event.h

@@ -15,6 +15,7 @@
 #include <string>
 
 #include "base/atomicops.h"
+#include "base/debug/debugging_flags.h"
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "base/trace_event/common/trace_event_common.h"
@@ -426,8 +427,12 @@
   INTERNAL_TRACE_EVENT_UID(ScopedContext)                                  \
   INTERNAL_TRACE_EVENT_UID(scoped_context)(context);
 
+#if BUILDFLAG(ENABLE_LOCATION_SOURCE)
+
 // Implementation detail: internal macro to trace a task execution with the
 // location where it was posted from.
+//
+// This implementation is for when location sources are available.
 #define INTERNAL_TRACE_TASK_EXECUTION(run_function, task)                 \
   TRACE_EVENT2("toplevel", run_function, "src_file",                      \
                (task).posted_from.file_name(), "src_func",                \
@@ -435,6 +440,17 @@
   TRACE_HEAP_PROFILER_API_SCOPED_TASK_EXECUTION INTERNAL_TRACE_EVENT_UID( \
       task_event)((task).posted_from.file_name());
 
+#else
+
+// TODO(http://crbug.com760702) remove file name and just pass the program
+// counter to the heap profiler macro.
+#define INTERNAL_TRACE_TASK_EXECUTION(run_function, task)                      \
+  TRACE_EVENT1("toplevel", run_function, "src", (task).posted_from.ToString()) \
+  TRACE_HEAP_PROFILER_API_SCOPED_TASK_EXECUTION INTERNAL_TRACE_EVENT_UID(      \
+      task_event)((task).posted_from.file_name());
+
+#endif
+
 namespace trace_event_internal {
 
 // Specify these values when the corresponding argument of AddTraceEvent is not

diff --git a/base/tracked_objects.h b/base/tracked_objects.h
index b3aed63..d77629e 100644
--- a/base/tracked_objects.h
+++ b/base/tracked_objects.h

@@ -553,7 +553,7 @@
     STATUS_LAST = PROFILING_ACTIVE
   };
 
-  typedef std::unordered_map<Location, Births*, Location::Hash> BirthMap;
+  typedef std::unordered_map<Location, Births*> BirthMap;
   typedef std::map<const Births*, DeathData> DeathMap;
 
   // Initialize the current thread context with a new instance of ThreadData.

diff --git a/base/tracked_objects_unittest.cc b/base/tracked_objects_unittest.cc
index e3f1ff1a..b4bfe53 100644
--- a/base/tracked_objects_unittest.cc
+++ b/base/tracked_objects_unittest.cc

@@ -19,6 +19,8 @@
 #include "base/tracking_info.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+// Various tests use the address of the line number as a fake unique PC for
+// Locations that need to be equivalent.
 const int kLineNumber = 1776;
 const char kFile[] = "FixedUnitTestFileName";
 const char kWorkerThreadName[] = "WorkerThread-*";
@@ -189,7 +191,7 @@
 
   // Instigate tracking on a single tracked object, on our thread.
   const char kFunction[] = "TinyStartupShutdown";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   ThreadData::TallyABirthIfActive(location);
 
   ThreadData* data = ThreadData::first();
@@ -553,7 +555,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::DEACTIVATED);
 
   const char kFunction[] = "DeactivatedBirthOnlyToSnapshotWorkerThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, std::string());
 
   ProcessDataSnapshot process_data;
@@ -575,7 +577,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::DEACTIVATED);
 
   const char kFunction[] = "DeactivatedBirthOnlyToSnapshotMainThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   ProcessDataSnapshot process_data;
@@ -596,7 +598,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "BirthOnlyToSnapshotWorkerThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, std::string());
 
   ProcessDataSnapshot process_data;
@@ -609,7 +611,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "BirthOnlyToSnapshotMainThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   ProcessDataSnapshot process_data;
@@ -622,7 +624,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "LifeCycleToSnapshotMainThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted = base::TimeTicks::FromInternalValue(1000);
@@ -651,7 +653,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "TwoPhases";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted = base::TimeTicks::FromInternalValue(1000);
@@ -754,7 +756,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "ThreePhases";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
 
   // Phase 0
   {
@@ -901,7 +903,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "TwoPhasesSecondEmpty";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   ThreadData::InitializeThreadContext(kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -969,7 +971,7 @@
   ThreadData::OnProfilingPhaseCompleted(0);
 
   const char kFunction[] = "TwoPhasesSecondEmpty";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   ThreadData::InitializeThreadContext(kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -1031,7 +1033,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "LifeCycleMidDeactivatedToSnapshotMainThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -1067,7 +1069,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::DEACTIVATED);
 
   const char kFunction[] = "LifeCyclePreDeactivatedToSnapshotMainThread";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -1105,7 +1107,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "TwoLives";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -1148,7 +1150,7 @@
   // Use a well named thread.
   ThreadData::InitializeThreadContext(kMainThreadName);
   const char kFunction[] = "DifferentLives";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
 
   const base::TimeTicks kTimePosted =
       base::TimeTicks() + base::TimeDelta::FromMilliseconds(1);
@@ -1168,7 +1170,8 @@
   ThreadData::TallyRunOnNamedThreadIfTracking(pending_task, stopwatch);
 
   const int kSecondFakeLineNumber = 999;
-  Location second_location(kFunction, kFile, kSecondFakeLineNumber, NULL);
+  Location second_location(kFunction, kFile, kSecondFakeLineNumber,
+                           &kSecondFakeLineNumber);
 
   // TrackingInfo will call TallyABirth() during construction.
   base::TrackingInfo pending_task2(second_location, kDelayedStartTime);
@@ -1223,7 +1226,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "TaskWithNestedExclusion";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -1258,7 +1261,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "TaskWith2NestedExclusions";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
   TallyABirth(location, kMainThreadName);
 
   const base::TimeTicks kTimePosted =
@@ -1299,7 +1302,7 @@
   ThreadData::InitializeAndSetTrackingStatus(ThreadData::PROFILING_ACTIVE);
 
   const char kFunction[] = "TaskWithNestedExclusionWithNestedTask";
-  Location location(kFunction, kFile, kLineNumber, NULL);
+  Location location(kFunction, kFile, kLineNumber, &kLineNumber);
 
   const int kSecondFakeLineNumber = 999;
 
@@ -1320,7 +1323,8 @@
     TaskStopwatch exclusion_stopwatch;
     exclusion_stopwatch.Start();
     {
-      Location second_location(kFunction, kFile, kSecondFakeLineNumber, NULL);
+      Location second_location(kFunction, kFile, kSecondFakeLineNumber,
+                               &kSecondFakeLineNumber);
       base::TrackingInfo nested_task(second_location, kDelayedStartTime);
        // Overwrite implied Now().
       nested_task.time_posted =

diff --git a/base/values.h b/base/values.h
index 9c5d946..804ea70 100644
--- a/base/values.h
+++ b/base/values.h

@@ -47,6 +47,35 @@
 // via passing the appropriate type or backing storage to the constructor.
 //
 // See the file-level comment above for more information.
+//
+// base::Value is currently in the process of being refactored. Design doc:
+// https://docs.google.com/document/d/1uDLu5uTRlCWePxQUEHc8yNQdEoE1BDISYdpggWEABnw
+//
+// Previously (which is how most code that currently exists is written), Value
+// used derived types to implement the individual data types, and base::Value
+// was just a base class to refer to them. This required everything be heap
+// allocated.
+//
+// OLD WAY:
+//
+//   std::unique_ptr<base::Value> GetFoo() {
+//     std::unique_ptr<DictionaryValue> dict;
+//     dict->SetString("mykey", foo);
+//     return dict;
+//   }
+//
+// The new design makes base::Value a variant type that holds everything in
+// a union. It is now recommended to pass by value with std::move rather than
+// use heap allocated values. The DictionaryValue and ListValue subclasses
+// exist only as a compatibility shim that we're in the process of removing.
+//
+// NEW WAY:
+//
+//   base::Value GetFoo() {
+//     base::Value dict(base::Value::Type::DICTIONARY);
+//     dict.SetKey("mykey", base::Value(foo));
+//     return dict;
+//   }
 class BASE_EXPORT Value {
  public:
   using BlobStorage = std::vector<char>;

diff --git a/build/android/apk_operations.py b/build/android/apk_operations.py
index ee5979c0..611439fb 100755
--- a/build/android/apk_operations.py
+++ b/build/android/apk_operations.py

@@ -887,7 +887,9 @@
   run_tests_helper.SetLogLevel(args.verbose_count)
   args.command.ProcessArgs(args)
   args.command.Run()
-  _SaveDeviceCaches(args.command.devices, output_directory)
+  # Incremental install depends on the cache being cleared when uninstalling.
+  if args.command.name != 'uninstall':
+    _SaveDeviceCaches(args.command.devices, output_directory)
 
 
 # TODO(agrieve): Remove =None from target_cpu on or after October 2017.

diff --git a/build/android/incremental_install/installer.py b/build/android/incremental_install/installer.py
index 92f86af..9094bf00 100755
--- a/build/android/incremental_install/installer.py
+++ b/build/android/incremental_install/installer.py

@@ -182,7 +182,6 @@
   cache_path = _DeviceCachePath(device)
   def restore_cache():
     if not enable_device_cache:
-      logging.info('Ignoring device cache')
       return
     if os.path.exists(cache_path):
       logging.info('Using device cache: %s', cache_path)
@@ -194,6 +193,8 @@
       logging.info('No device cache present: %s', cache_path)
 
   def save_cache():
+    if not enable_device_cache:
+      return
     with open(cache_path, 'w') as f:
       f.write(device.DumpCacheData())
       logging.info('Wrote device cache: %s', cache_path)

diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
index d0795d7d..d973c5e 100644
--- a/build/config/BUILDCONFIG.gn
+++ b/build/config/BUILDCONFIG.gn

@@ -503,6 +503,14 @@
 # The values configured here will be automatically set on the scope of the
 # corresponding target. Target definitions can add or remove to the settings
 # here as needed.
+#
+# WHAT GOES HERE?
+#
+# Other than the main compiler and linker configs, the only reason for a config
+# to be in this list is if some targets need to explicitly override that config
+# by removing it. This is how targets opt-out of flags. If you don't have that
+# requirement and just need to add a config everywhere, reference it as a
+# sub-config of an existing one, most commonly the main "compiler" one.
 
 # Holds all configs used for running the compiler.
 default_compiler_configs = [

diff --git a/cc/paint/paint_op_buffer_unittest.cc b/cc/paint/paint_op_buffer_unittest.cc
index b9601e4..5626ded 100644
--- a/cc/paint/paint_op_buffer_unittest.cc
+++ b/cc/paint/paint_op_buffer_unittest.cc

@@ -1280,7 +1280,11 @@
 std::vector<SkRect> test_rects = {
     SkRect::MakeXYWH(1, 2.5, 3, 4), SkRect::MakeXYWH(0, 0, 0, 0),
     SkRect::MakeLargest(),          SkRect::MakeXYWH(0.5f, 0.5f, 8.2f, 8.2f),
-    SkRect::MakeXYWH(-1, -1, 0, 0), SkRect::MakeXYWH(-100, -101, -102, -103)};
+    SkRect::MakeXYWH(-1, -1, 0, 0), SkRect::MakeXYWH(-100, -101, -102, -103),
+    SkRect::MakeXYWH(0, 0, 0, 0),   SkRect::MakeXYWH(0, 0, 0, 0),
+    SkRect::MakeXYWH(0, 0, 0, 0),   SkRect::MakeXYWH(0, 0, 0, 0),
+    SkRect::MakeXYWH(0, 0, 0, 0),   SkRect::MakeXYWH(0, 0, 0, 0),
+};
 
 std::vector<SkRRect> test_rrects = {
     SkRRect::MakeEmpty(), SkRRect::MakeOval(SkRect::MakeXYWH(1, 2, 3, 4)),
@@ -1421,7 +1425,15 @@
 
       return flags;
     }(),
-    PaintFlags(),
+    [] {
+      PaintFlags flags;
+      SkColor colors[3] = {SkColorSetARGB(1, 2, 3, 4),
+                           SkColorSetARGB(4, 3, 2, 1),
+                           SkColorSetARGB(0, 10, 20, 30)};
+      flags.setShader(PaintShader::MakeSweepGradient(
+          0.2f, -0.8f, colors, nullptr, 3, SkShader::kMirror_TileMode, 10, 20));
+      return flags;
+    }(),
     PaintFlags(),
     PaintFlags(),
 };

diff --git a/cc/paint/paint_op_reader.cc b/cc/paint/paint_op_reader.cc
index 692c5ac..31066ce 100644
--- a/cc/paint/paint_op_reader.cc
+++ b/cc/paint/paint_op_reader.cc

@@ -265,9 +265,8 @@
 
   decltype(ref.positions_)::size_type positions_size = 0;
   ReadSimple(&positions_size);
-  // TODO(enne): positions and colors have to have the same count, so maybe
-  // don't serialize this either?
-  if (positions_size != colors_size) {
+  // Positions are optional. If they exist, they have the same count as colors.
+  if (positions_size > 0 && positions_size != colors_size) {
     valid_ = false;
     return;
   }

diff --git a/cc/resources/display_resource_provider.cc b/cc/resources/display_resource_provider.cc
index 2e9e70b..cb31b65 100644
--- a/cc/resources/display_resource_provider.cc
+++ b/cc/resources/display_resource_provider.cc

@@ -6,6 +6,7 @@
 
 #include "base/trace_event/trace_event.h"
 #include "components/viz/common/resources/resource_format_utils.h"
+#include "components/viz/common/resources/shared_bitmap_manager.h"
 #include "gpu/command_buffer/client/gles2_interface.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
 
@@ -29,7 +30,10 @@
                        enable_color_correct_rasterization,
                        resource_settings) {}
 
-DisplayResourceProvider::~DisplayResourceProvider() {}
+DisplayResourceProvider::~DisplayResourceProvider() {
+  while (!children_.empty())
+    DestroyChildInternal(children_.begin(), FOR_SHUTDOWN);
+}
 
 #if defined(OS_ANDROID)
 void DisplayResourceProvider::SendPromotionHints(
@@ -89,6 +93,13 @@
   }
 }
 
+DisplayResourceProvider::Child::Child()
+    : marked_for_deletion(false), needs_sync_tokens(true) {}
+
+DisplayResourceProvider::Child::Child(const Child& other) = default;
+
+DisplayResourceProvider::Child::~Child() {}
+
 int DisplayResourceProvider::CreateChild(
     const ReturnCallback& return_callback) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
@@ -114,6 +125,142 @@
   DestroyChildInternal(it, NORMAL);
 }
 
+void DisplayResourceProvider::DestroyChildInternal(ChildMap::iterator it,
+                                                   DeleteStyle style) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  Child& child = it->second;
+  DCHECK(style == FOR_SHUTDOWN || !child.marked_for_deletion);
+
+  ResourceIdArray resources_for_child;
+
+  for (ResourceIdMap::iterator child_it = child.child_to_parent_map.begin();
+       child_it != child.child_to_parent_map.end(); ++child_it) {
+    viz::ResourceId id = child_it->second;
+    resources_for_child.push_back(id);
+  }
+
+  child.marked_for_deletion = true;
+
+  DeleteAndReturnUnusedResourcesToChild(it, style, resources_for_child);
+}
+
+void DisplayResourceProvider::DeleteAndReturnUnusedResourcesToChild(
+    ChildMap::iterator child_it,
+    DeleteStyle style,
+    const ResourceIdArray& unused) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  DCHECK(child_it != children_.end());
+  Child* child_info = &child_it->second;
+
+  if (unused.empty() && !child_info->marked_for_deletion)
+    return;
+
+  std::vector<viz::ReturnedResource> to_return;
+  to_return.reserve(unused.size());
+  std::vector<viz::ReturnedResource*> need_synchronization_resources;
+  std::vector<GLbyte*> unverified_sync_tokens;
+
+  GLES2Interface* gl = ContextGL();
+
+  for (viz::ResourceId local_id : unused) {
+    ResourceMap::iterator it = resources_.find(local_id);
+    CHECK(it != resources_.end());
+    Resource& resource = it->second;
+
+    DCHECK(!resource.locked_for_write);
+
+    viz::ResourceId child_id = resource.id_in_child;
+    DCHECK(child_info->child_to_parent_map.count(child_id));
+
+    bool is_lost = resource.lost ||
+                   (IsGpuResourceType(resource.type) && lost_context_provider_);
+    if (resource.exported_count > 0 || resource.lock_for_read_count > 0) {
+      if (style != FOR_SHUTDOWN) {
+        // Defer this resource deletion.
+        resource.marked_for_deletion = true;
+        continue;
+      }
+      // We can't postpone the deletion, so we'll have to lose it.
+      is_lost = true;
+    } else if (!ReadLockFenceHasPassed(&resource)) {
+      // TODO(dcastagna): see if it's possible to use this logic for
+      // the branch above too, where the resource is locked or still exported.
+      if (style != FOR_SHUTDOWN && !child_info->marked_for_deletion) {
+        // Defer this resource deletion.
+        resource.marked_for_deletion = true;
+        continue;
+      }
+      // We can't postpone the deletion, so we'll have to lose it.
+      is_lost = true;
+    }
+
+    if (IsGpuResourceType(resource.type) &&
+        resource.filter != resource.original_filter) {
+      DCHECK(resource.target);
+      DCHECK(resource.gl_id);
+      DCHECK(gl);
+      gl->BindTexture(resource.target, resource.gl_id);
+      gl->TexParameteri(resource.target, GL_TEXTURE_MIN_FILTER,
+                        resource.original_filter);
+      gl->TexParameteri(resource.target, GL_TEXTURE_MAG_FILTER,
+                        resource.original_filter);
+      resource.SetLocallyUsed();
+    }
+
+    viz::ReturnedResource returned;
+    returned.id = child_id;
+    returned.sync_token = resource.mailbox().sync_token();
+    returned.count = resource.imported_count;
+    returned.lost = is_lost;
+    to_return.push_back(returned);
+
+    if (IsGpuResourceType(resource.type) && child_info->needs_sync_tokens) {
+      if (resource.needs_sync_token()) {
+        need_synchronization_resources.push_back(&to_return.back());
+      } else if (returned.sync_token.HasData() &&
+                 !returned.sync_token.verified_flush()) {
+        // Before returning any sync tokens, they must be verified.
+        unverified_sync_tokens.push_back(returned.sync_token.GetData());
+      }
+    }
+
+    child_info->child_to_parent_map.erase(child_id);
+    resource.imported_count = 0;
+    DeleteResourceInternal(it, style);
+  }
+
+  gpu::SyncToken new_sync_token;
+  if (!need_synchronization_resources.empty()) {
+    DCHECK(child_info->needs_sync_tokens);
+    DCHECK(gl);
+    const uint64_t fence_sync = gl->InsertFenceSyncCHROMIUM();
+    gl->OrderingBarrierCHROMIUM();
+    gl->GenUnverifiedSyncTokenCHROMIUM(fence_sync, new_sync_token.GetData());
+    unverified_sync_tokens.push_back(new_sync_token.GetData());
+  }
+
+  if (!unverified_sync_tokens.empty()) {
+    DCHECK(child_info->needs_sync_tokens);
+    DCHECK(gl);
+    gl->VerifySyncTokensCHROMIUM(unverified_sync_tokens.data(),
+                                 unverified_sync_tokens.size());
+  }
+
+  // Set sync token after verification.
+  for (viz::ReturnedResource* returned : need_synchronization_resources)
+    returned->sync_token = new_sync_token;
+
+  if (!to_return.empty())
+    child_info->return_callback.Run(to_return,
+                                    blocking_main_thread_task_runner_);
+
+  if (child_info->marked_for_deletion &&
+      child_info->child_to_parent_map.empty()) {
+    children_.erase(child_it);
+  }
+}
+
 void DisplayResourceProvider::ReceiveFromChild(
     int child,
     const std::vector<viz::TransferableResource>& resources) {
@@ -220,6 +367,77 @@
   color_space_ = resource->color_space;
 }
 
+const ResourceProvider::Resource* DisplayResourceProvider::LockForRead(
+    viz::ResourceId id) {
+  Resource* resource = GetResource(id);
+  DCHECK(!resource->locked_for_write)
+      << "locked for write: " << resource->locked_for_write;
+  DCHECK_EQ(resource->exported_count, 0);
+  // Uninitialized! Call SetPixels or LockForWrite first.
+  DCHECK(resource->allocated);
+
+  // Mailbox sync_tokens must be processed by a call to WaitSyncToken() prior to
+  // calling LockForRead().
+  DCHECK_NE(Resource::NEEDS_WAIT, resource->synchronization_state());
+
+  if (IsGpuResourceType(resource->type) && !resource->gl_id) {
+    DCHECK(resource->origin != Resource::INTERNAL);
+    DCHECK(resource->mailbox().IsTexture());
+
+    GLES2Interface* gl = ContextGL();
+    DCHECK(gl);
+    resource->gl_id = gl->CreateAndConsumeTextureCHROMIUM(
+        resource->mailbox().target(), resource->mailbox().name());
+    resource->SetLocallyUsed();
+  }
+
+  if (!resource->pixels && resource->has_shared_bitmap_id &&
+      shared_bitmap_manager_) {
+    std::unique_ptr<viz::SharedBitmap> bitmap =
+        shared_bitmap_manager_->GetSharedBitmapFromId(
+            resource->size, resource->shared_bitmap_id);
+    if (bitmap) {
+      resource->shared_bitmap = bitmap.release();
+      resource->pixels = resource->shared_bitmap->pixels();
+    }
+  }
+
+  resource->lock_for_read_count++;
+  if (resource->read_lock_fences_enabled) {
+    if (current_read_lock_fence_.get())
+      current_read_lock_fence_->Set();
+    resource->read_lock_fence = current_read_lock_fence_;
+  }
+
+  return resource;
+}
+
+void DisplayResourceProvider::UnlockForRead(viz::ResourceId id) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  ResourceMap::iterator it = resources_.find(id);
+  CHECK(it != resources_.end());
+
+  Resource* resource = &it->second;
+  DCHECK_GT(resource->lock_for_read_count, 0);
+  DCHECK_EQ(resource->exported_count, 0);
+  resource->lock_for_read_count--;
+  if (resource->marked_for_deletion && !resource->lock_for_read_count) {
+    if (!resource->child_id) {
+      // The resource belongs to this ResourceProvider, so it can be destroyed.
+      DeleteResourceInternal(it, NORMAL);
+    } else {
+      if (batch_return_resources_) {
+        batched_returning_resources_[resource->child_id].push_back(id);
+      } else {
+        ChildMap::iterator child_it = children_.find(resource->child_id);
+        ResourceIdArray unused;
+        unused.push_back(id);
+        DeleteAndReturnUnusedResourcesToChild(child_it, NORMAL, unused);
+      }
+    }
+  }
+}
+
 DisplayResourceProvider::ScopedReadLockGL::~ScopedReadLockGL() {
   resource_provider_->UnlockForRead(resource_id_);
 }

diff --git a/cc/resources/display_resource_provider.h b/cc/resources/display_resource_provider.h
index 3358663..33ecbb1 100644
--- a/cc/resources/display_resource_provider.h
+++ b/cc/resources/display_resource_provider.h

@@ -143,6 +143,11 @@
     DISALLOW_COPY_AND_ASSIGN(ScopedBatchReturnResources);
   };
 
+  // Sets the current read fence. If a resource is locked for read
+  // and has read fences enabled, the resource will not allow writes
+  // until this fence has passed.
+  void SetReadLockFence(Fence* fence) { current_read_lock_fence_ = fence; }
+
   // Creates accounting for a child. Returns a child ID.
   int CreateChild(const ReturnCallback& return_callback);
 
@@ -179,8 +184,30 @@
  private:
   friend class ScopedBatchReturnResources;
 
+  const Resource* LockForRead(viz::ResourceId id);
+  void UnlockForRead(viz::ResourceId id);
+
+  struct Child {
+    Child();
+    Child(const Child& other);
+    ~Child();
+
+    ResourceIdMap child_to_parent_map;
+    ReturnCallback return_callback;
+    bool marked_for_deletion;
+    bool needs_sync_tokens;
+  };
+  using ChildMap = std::unordered_map<int, Child>;
+
+  void DeleteAndReturnUnusedResourcesToChild(ChildMap::iterator child_it,
+                                             DeleteStyle style,
+                                             const ResourceIdArray& unused);
+  void DestroyChildInternal(ChildMap::iterator it, DeleteStyle style);
+
   void SetBatchReturnResources(bool aggregate);
 
+  scoped_refptr<Fence> current_read_lock_fence_;
+  ChildMap children_;
   base::flat_map<viz::ResourceId, sk_sp<SkImage>> resource_sk_image_;
 
   DISALLOW_COPY_AND_ASSIGN(DisplayResourceProvider);

diff --git a/cc/resources/resource_provider.cc b/cc/resources/resource_provider.cc
index c1c28b5f..b9ed1ba 100644
--- a/cc/resources/resource_provider.cc
+++ b/cc/resources/resource_provider.cc

@@ -317,13 +317,6 @@
   SetSynchronized();
 }
 
-ResourceProvider::Child::Child()
-    : marked_for_deletion(false), needs_sync_tokens(true) {}
-
-ResourceProvider::Child::Child(const Child& other) = default;
-
-ResourceProvider::Child::~Child() {}
-
 ResourceProvider::Settings::Settings(
     viz::ContextProvider* compositor_context_provider,
     bool delegated_sync_points_required,
@@ -414,8 +407,6 @@
   base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
       this);
 
-  while (!children_.empty())
-    DestroyChildInternal(children_.begin(), FOR_SHUTDOWN);
   while (!resources_.empty())
     DeleteResourceInternal(resources_.begin(), FOR_SHUTDOWN);
 
@@ -629,7 +620,8 @@
     bool read_lock_fences_enabled,
     gfx::BufferFormat buffer_format) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  // Just store the information. Mailbox will be consumed in LockForRead().
+  // Just store the information. Mailbox will be consumed in
+  // DisplayResourceProvider::LockForRead().
   viz::ResourceId id = next_id_++;
   DCHECK(mailbox.IsValid());
   Resource* resource = nullptr;
@@ -890,77 +882,6 @@
   return &it->second;
 }
 
-const ResourceProvider::Resource* ResourceProvider::LockForRead(
-    viz::ResourceId id) {
-  Resource* resource = GetResource(id);
-  DCHECK(!resource->locked_for_write)
-      << "locked for write: " << resource->locked_for_write;
-  DCHECK_EQ(resource->exported_count, 0);
-  // Uninitialized! Call SetPixels or LockForWrite first.
-  DCHECK(resource->allocated);
-
-  // Mailbox sync_tokens must be processed by a call to WaitSyncToken() prior to
-  // calling LockForRead().
-  DCHECK_NE(Resource::NEEDS_WAIT, resource->synchronization_state());
-
-  if (IsGpuResourceType(resource->type) && !resource->gl_id) {
-    DCHECK(resource->origin != Resource::INTERNAL);
-    DCHECK(resource->mailbox().IsTexture());
-
-    GLES2Interface* gl = ContextGL();
-    DCHECK(gl);
-    resource->gl_id = gl->CreateAndConsumeTextureCHROMIUM(
-        resource->mailbox().target(), resource->mailbox().name());
-    resource->SetLocallyUsed();
-  }
-
-  if (!resource->pixels && resource->has_shared_bitmap_id &&
-      shared_bitmap_manager_) {
-    std::unique_ptr<viz::SharedBitmap> bitmap =
-        shared_bitmap_manager_->GetSharedBitmapFromId(
-            resource->size, resource->shared_bitmap_id);
-    if (bitmap) {
-      resource->shared_bitmap = bitmap.release();
-      resource->pixels = resource->shared_bitmap->pixels();
-    }
-  }
-
-  resource->lock_for_read_count++;
-  if (resource->read_lock_fences_enabled) {
-    if (current_read_lock_fence_.get())
-      current_read_lock_fence_->Set();
-    resource->read_lock_fence = current_read_lock_fence_;
-  }
-
-  return resource;
-}
-
-void ResourceProvider::UnlockForRead(viz::ResourceId id) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  ResourceMap::iterator it = resources_.find(id);
-  CHECK(it != resources_.end());
-
-  Resource* resource = &it->second;
-  DCHECK_GT(resource->lock_for_read_count, 0);
-  DCHECK_EQ(resource->exported_count, 0);
-  resource->lock_for_read_count--;
-  if (resource->marked_for_deletion && !resource->lock_for_read_count) {
-    if (!resource->child_id) {
-      // The resource belongs to this ResourceProvider, so it can be destroyed.
-      DeleteResourceInternal(it, NORMAL);
-    } else {
-      if (batch_return_resources_) {
-        batched_returning_resources_[resource->child_id].push_back(id);
-      } else {
-        ChildMap::iterator child_it = children_.find(resource->child_id);
-        ResourceIdArray unused;
-        unused.push_back(id);
-        DeleteAndReturnUnusedResourcesToChild(child_it, NORMAL, unused);
-      }
-    }
-  }
-}
-
 ResourceProvider::Resource* ResourceProvider::LockForWrite(viz::ResourceId id) {
   DCHECK(CanLockForWrite(id));
   Resource* resource = GetResource(id);
@@ -1211,6 +1132,7 @@
   resource->SetSynchronized();
   resource_provider_->UnlockForWrite(resource);
 }
+
 ResourceProvider::SynchronousFence::SynchronousFence(
     gpu::gles2::GLES2Interface* gl)
     : gl_(gl), has_synchronized_(true) {}
@@ -1238,142 +1160,6 @@
   gl_->Finish();
 }
 
-void ResourceProvider::DestroyChildInternal(ChildMap::iterator it,
-                                            DeleteStyle style) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-
-  Child& child = it->second;
-  DCHECK(style == FOR_SHUTDOWN || !child.marked_for_deletion);
-
-  ResourceIdArray resources_for_child;
-
-  for (ResourceIdMap::iterator child_it = child.child_to_parent_map.begin();
-       child_it != child.child_to_parent_map.end(); ++child_it) {
-    viz::ResourceId id = child_it->second;
-    resources_for_child.push_back(id);
-  }
-
-  child.marked_for_deletion = true;
-
-  DeleteAndReturnUnusedResourcesToChild(it, style, resources_for_child);
-}
-
-void ResourceProvider::DeleteAndReturnUnusedResourcesToChild(
-    ChildMap::iterator child_it,
-    DeleteStyle style,
-    const ResourceIdArray& unused) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  DCHECK(child_it != children_.end());
-  Child* child_info = &child_it->second;
-
-  if (unused.empty() && !child_info->marked_for_deletion)
-    return;
-
-  std::vector<viz::ReturnedResource> to_return;
-  to_return.reserve(unused.size());
-  std::vector<viz::ReturnedResource*> need_synchronization_resources;
-  std::vector<GLbyte*> unverified_sync_tokens;
-
-  GLES2Interface* gl = ContextGL();
-
-  for (viz::ResourceId local_id : unused) {
-    ResourceMap::iterator it = resources_.find(local_id);
-    CHECK(it != resources_.end());
-    Resource& resource = it->second;
-
-    DCHECK(!resource.locked_for_write);
-
-    viz::ResourceId child_id = resource.id_in_child;
-    DCHECK(child_info->child_to_parent_map.count(child_id));
-
-    bool is_lost = resource.lost ||
-                   (IsGpuResourceType(resource.type) && lost_context_provider_);
-    if (resource.exported_count > 0 || resource.lock_for_read_count > 0) {
-      if (style != FOR_SHUTDOWN) {
-        // Defer this resource deletion.
-        resource.marked_for_deletion = true;
-        continue;
-      }
-      // We can't postpone the deletion, so we'll have to lose it.
-      is_lost = true;
-    } else if (!ReadLockFenceHasPassed(&resource)) {
-      // TODO(dcastagna): see if it's possible to use this logic for
-      // the branch above too, where the resource is locked or still exported.
-      if (style != FOR_SHUTDOWN && !child_info->marked_for_deletion) {
-        // Defer this resource deletion.
-        resource.marked_for_deletion = true;
-        continue;
-      }
-      // We can't postpone the deletion, so we'll have to lose it.
-      is_lost = true;
-    }
-
-    if (IsGpuResourceType(resource.type) &&
-        resource.filter != resource.original_filter) {
-      DCHECK(resource.target);
-      DCHECK(resource.gl_id);
-      DCHECK(gl);
-      gl->BindTexture(resource.target, resource.gl_id);
-      gl->TexParameteri(resource.target, GL_TEXTURE_MIN_FILTER,
-                        resource.original_filter);
-      gl->TexParameteri(resource.target, GL_TEXTURE_MAG_FILTER,
-                        resource.original_filter);
-      resource.SetLocallyUsed();
-    }
-
-    viz::ReturnedResource returned;
-    returned.id = child_id;
-    returned.sync_token = resource.mailbox().sync_token();
-    returned.count = resource.imported_count;
-    returned.lost = is_lost;
-    to_return.push_back(returned);
-
-    if (IsGpuResourceType(resource.type) && child_info->needs_sync_tokens) {
-      if (resource.needs_sync_token()) {
-        need_synchronization_resources.push_back(&to_return.back());
-      } else if (returned.sync_token.HasData() &&
-                 !returned.sync_token.verified_flush()) {
-        // Before returning any sync tokens, they must be verified.
-        unverified_sync_tokens.push_back(returned.sync_token.GetData());
-      }
-    }
-
-    child_info->child_to_parent_map.erase(child_id);
-    resource.imported_count = 0;
-    DeleteResourceInternal(it, style);
-  }
-
-  gpu::SyncToken new_sync_token;
-  if (!need_synchronization_resources.empty()) {
-    DCHECK(child_info->needs_sync_tokens);
-    DCHECK(gl);
-    const uint64_t fence_sync = gl->InsertFenceSyncCHROMIUM();
-    gl->OrderingBarrierCHROMIUM();
-    gl->GenUnverifiedSyncTokenCHROMIUM(fence_sync, new_sync_token.GetData());
-    unverified_sync_tokens.push_back(new_sync_token.GetData());
-  }
-
-  if (!unverified_sync_tokens.empty()) {
-    DCHECK(child_info->needs_sync_tokens);
-    DCHECK(gl);
-    gl->VerifySyncTokensCHROMIUM(unverified_sync_tokens.data(),
-                                 unverified_sync_tokens.size());
-  }
-
-  // Set sync token after verification.
-  for (viz::ReturnedResource* returned : need_synchronization_resources)
-    returned->sync_token = new_sync_token;
-
-  if (!to_return.empty())
-    child_info->return_callback.Run(to_return,
-                                    blocking_main_thread_task_runner_);
-
-  if (child_info->marked_for_deletion &&
-      child_info->child_to_parent_map.empty()) {
-    children_.erase(child_it);
-  }
-}
-
 GLenum ResourceProvider::BindForSampling(viz::ResourceId resource_id,
                                          GLenum unit,
                                          GLenum filter) {

diff --git a/cc/resources/resource_provider.h b/cc/resources/resource_provider.h
index 1b0b67b0..a1a900aa 100644
--- a/cc/resources/resource_provider.h
+++ b/cc/resources/resource_provider.h

@@ -345,11 +345,6 @@
   // For tests only!
   void CreateForTesting(viz::ResourceId id);
 
-  // Sets the current read fence. If a resource is locked for read
-  // and has read fences enabled, the resource will not allow writes
-  // until this fence has passed.
-  void SetReadLockFence(Fence* fence) { current_read_lock_fence_ = fence; }
-
   // Indicates if we can currently lock this resource for write.
   bool CanLockForWrite(viz::ResourceId id);
 
@@ -522,22 +517,8 @@
   };
   using ResourceMap = std::unordered_map<viz::ResourceId, Resource>;
 
-  struct Child {
-    Child();
-    Child(const Child& other);
-    ~Child();
-
-    ResourceIdMap child_to_parent_map;
-    ReturnCallback return_callback;
-    bool marked_for_deletion;
-    bool needs_sync_tokens;
-  };
-  using ChildMap = std::unordered_map<int, Child>;
-
   Resource* InsertResource(viz::ResourceId id, Resource resource);
   Resource* GetResource(viz::ResourceId id);
-  const Resource* LockForRead(viz::ResourceId id);
-  void UnlockForRead(viz::ResourceId id);
   Resource* LockForWrite(viz::ResourceId id);
   void UnlockForWrite(Resource* resource);
 
@@ -563,13 +544,14 @@
     FOR_SHUTDOWN,
   };
   void DeleteResourceInternal(ResourceMap::iterator it, DeleteStyle style);
-  void DeleteAndReturnUnusedResourcesToChild(ChildMap::iterator child_it,
-                                             DeleteStyle style,
-                                             const ResourceIdArray& unused);
-  void DestroyChildInternal(ChildMap::iterator it, DeleteStyle style);
 
   void CreateMailbox(Resource* resource);
 
+  bool ReadLockFenceHasPassed(const Resource* resource) {
+    return !resource->read_lock_fence.get() ||
+           resource->read_lock_fence->HasPassed();
+  }
+
   // Returns null if we do not have a viz::ContextProvider.
   gpu::gles2::GLES2Interface* ContextGL() const;
 
@@ -595,7 +577,6 @@
   } const settings_;
 
   ResourceMap resources_;
-  ChildMap children_;
 
   // Keep track of whether deleted resources should be batched up or returned
   // immediately.
@@ -610,6 +591,8 @@
   viz::ResourceId next_id_;
   int next_child_;
 
+  bool lost_context_provider_;
+
   THREAD_CHECKER(thread_checker_);
 
 #if defined(OS_ANDROID)
@@ -618,11 +601,6 @@
 #endif
 
  private:
-  bool ReadLockFenceHasPassed(const Resource* resource) {
-    return !resource->read_lock_fence.get() ||
-           resource->read_lock_fence->HasPassed();
-  }
-
   viz::ResourceId CreateGpuResource(const gfx::Size& size,
                                     TextureHint hint,
                                     ResourceType type,
@@ -636,8 +614,6 @@
 
   bool IsGLContextLost() const;
 
-  bool lost_context_provider_;
-  scoped_refptr<Fence> current_read_lock_fence_;
   std::unique_ptr<TextureIdAllocator> texture_id_allocator_;
   viz::BufferToTextureTargetMap buffer_to_texture_target_map_;
 

diff --git a/cc/resources/resource_provider_unittest.cc b/cc/resources/resource_provider_unittest.cc
index f360486..151fac7 100644
--- a/cc/resources/resource_provider_unittest.cc
+++ b/cc/resources/resource_provider_unittest.cc

@@ -2451,8 +2451,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -2494,8 +2494,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -2538,8 +2538,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -2857,8 +2857,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -2912,8 +2912,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3075,8 +3075,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3132,8 +3132,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3188,8 +3188,8 @@
   auto context_provider = TestContextProvider::Create(std::move(context_owned));
   context_provider->BindToCurrentThread();
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3300,8 +3300,8 @@
   context_provider->BindToCurrentThread();
 
   gfx::Size size(4, 4);
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3332,8 +3332,8 @@
   context_provider->BindToCurrentThread();
 
   gfx::Size size(4, 4);
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3388,8 +3388,8 @@
 
   {
     size_t kTextureAllocationChunkSize = 1;
-    std::unique_ptr<ResourceProvider> resource_provider(
-        std::make_unique<ResourceProvider>(
+    std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+        std::make_unique<LayerTreeResourceProvider>(
             context_provider.get(), shared_bitmap_manager.get(), nullptr,
             nullptr, kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
             CreateResourceSettings(kTextureAllocationChunkSize)));
@@ -3406,8 +3406,8 @@
 
   {
     size_t kTextureAllocationChunkSize = 8;
-    std::unique_ptr<ResourceProvider> resource_provider(
-        std::make_unique<ResourceProvider>(
+    std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+        std::make_unique<LayerTreeResourceProvider>(
             context_provider.get(), shared_bitmap_manager.get(), nullptr,
             nullptr, kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
             CreateResourceSettings(kTextureAllocationChunkSize)));
@@ -3467,8 +3467,8 @@
   const viz::ResourceFormat format = viz::RGBA_8888;
   const unsigned kTextureId = 123u;
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3517,8 +3517,8 @@
   const unsigned kTextureId = 123u;
   const unsigned kImageId = 234u;
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3570,8 +3570,8 @@
   const unsigned kTextureId = 123u;
   const unsigned kWorkerTextureId = 234u;
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,
@@ -3655,8 +3655,8 @@
   const unsigned kWorkerTextureId = 234u;
   const unsigned kImageId = 345u;
 
-  std::unique_ptr<ResourceProvider> resource_provider(
-      std::make_unique<ResourceProvider>(
+  std::unique_ptr<LayerTreeResourceProvider> resource_provider(
+      std::make_unique<LayerTreeResourceProvider>(
           context_provider.get(), shared_bitmap_manager_.get(),
           gpu_memory_buffer_manager_.get(), nullptr,
           kDelegatedSyncPointsRequired, kEnableColorCorrectRendering,

diff --git a/chrome/android/java/res/drawable-hdpi/bottom_toolbar_top_line.png b/chrome/android/java/res/drawable-hdpi/bottom_toolbar_top_line.png
new file mode 100644
index 0000000..2e15178c
--- /dev/null
+++ b/chrome/android/java/res/drawable-hdpi/bottom_toolbar_top_line.png
Binary files differ

diff --git a/chrome/android/java/res/drawable-mdpi/bottom_toolbar_top_line.png b/chrome/android/java/res/drawable-mdpi/bottom_toolbar_top_line.png
new file mode 100644
index 0000000..c0b5740
--- /dev/null
+++ b/chrome/android/java/res/drawable-mdpi/bottom_toolbar_top_line.png
Binary files differ

diff --git a/chrome/android/java/res/drawable-xhdpi/bottom_toolbar_top_line.png b/chrome/android/java/res/drawable-xhdpi/bottom_toolbar_top_line.png
new file mode 100644
index 0000000..fc4236c
--- /dev/null
+++ b/chrome/android/java/res/drawable-xhdpi/bottom_toolbar_top_line.png
Binary files differ

diff --git a/chrome/android/java/res/drawable-xxhdpi/bottom_toolbar_top_line.png b/chrome/android/java/res/drawable-xxhdpi/bottom_toolbar_top_line.png
new file mode 100644
index 0000000..e976a1e
--- /dev/null
+++ b/chrome/android/java/res/drawable-xxhdpi/bottom_toolbar_top_line.png
Binary files differ

diff --git a/chrome/android/java/res/drawable/bottom_toolbar_shadow.xml b/chrome/android/java/res/drawable/bottom_toolbar_shadow.xml
index e1a4e41..242138a4 100644
--- a/chrome/android/java/res/drawable/bottom_toolbar_shadow.xml
+++ b/chrome/android/java/res/drawable/bottom_toolbar_shadow.xml

@@ -2,23 +2,15 @@
 <!-- Copyright 2017 The Chromium Authors. All rights reserved.
      Use of this source code is governed by a BSD-style license that can be
      found in the LICENSE file. -->
-
-<!-- ToolbarPhone uses this drawable to transition between shadows when
-     the omnibox focus changes. The bottom toolbar should not have a shadow
-     when the omnibox is unfocused so this TransitionDrawable uses an empty
-     shape for the focused drawable item.
-     TODO(twellington): Remove this after UX has a spec'ed out what the
-     bottom toolbar omnibox un/focus animations should look like. -->
-<transition xmlns:android="http://schemas.android.com/apk/res/android">
-    <item>
-        <shape
-            android:shape="rectangle"
-            android:gravity="top|fill_horizontal" >
-        </shape>
-    </item>
+<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
     <item>
         <bitmap
             android:src="@drawable/toolbar_shadow_focused"
             android:gravity="top|fill_horizontal" />
     </item>
-</transition>
+    <item>
+        <bitmap
+            android:src="@drawable/bottom_toolbar_top_line"
+            android:gravity="top|fill_horizontal" />
+    </item>
+</layer-list>

diff --git a/chrome/android/java/res/layout/suggestions_site_tile_grid_modern.xml b/chrome/android/java/res/layout/suggestions_site_tile_grid_modern.xml
new file mode 100644
index 0000000..0429215
--- /dev/null
+++ b/chrome/android/java/res/layout/suggestions_site_tile_grid_modern.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2017 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+
+<org.chromium.chrome.browser.suggestions.TileGridLayout
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:id="@+id/tile_grid_layout"
+    android:layout_width="match_parent"
+    android:layout_height="wrap_content"
+    android:layout_marginBottom="16dp"
+    android:layout_marginStart="@dimen/tile_grid_layout_padding_start"
+    android:layout_marginEnd="@dimen/tile_grid_layout_padding_end"
+    android:layout_gravity="center_horizontal" />

diff --git a/chrome/android/java/res/layout/tile_view_modern.xml b/chrome/android/java/res/layout/tile_view_modern.xml
index 86a04a4..5160f985 100644
--- a/chrome/android/java/res/layout/tile_view_modern.xml
+++ b/chrome/android/java/res/layout/tile_view_modern.xml

@@ -18,7 +18,7 @@
         android:layout_width="@dimen/tile_view_icon_size"
         android:layout_height="@dimen/tile_view_icon_size"
         android:layout_gravity="center_horizontal"
-        android:layout_marginTop="@dimen/tile_view_icon_margin_top"
+        android:layout_marginTop="@dimen/tile_view_icon_background_margin_top_modern"
         android:background="@drawable/tile_view_icon_background_modern" />
 
     <!-- The main icon. -->
@@ -36,7 +36,7 @@
         android:layout_width="@dimen/tile_view_icon_size"
         android:layout_height="@dimen/tile_view_icon_size"
         android:layout_gravity="center_horizontal"
-        android:layout_marginTop="@dimen/tile_view_icon_margin_top"
+        android:layout_marginTop="@dimen/tile_view_icon_background_margin_top_modern"
         android:background="@drawable/tile_view_highlight" />
 
     <!-- The offline badge. -->
@@ -45,8 +45,8 @@
         android:layout_width="@dimen/tile_view_offline_badge_size_modern"
         android:layout_height="@dimen/tile_view_offline_badge_size_modern"
         android:layout_gravity="top|end"
-        android:layout_marginTop="@dimen/tile_view_offline_badge_margin_modern"
-        android:layout_marginEnd="@dimen/tile_view_offline_badge_margin_modern"
+        android:layout_marginTop="@dimen/tile_view_offline_badge_margin_top_modern"
+        android:layout_marginEnd="@dimen/tile_view_offline_badge_margin_end_modern"
         android:visibility="gone"
         android:contentDescription="@string/accessibility_ntp_offline_badge"
         chrome:chrometint="@color/tile_view_offline_badge_tint"
@@ -57,7 +57,7 @@
         android:id="@+id/tile_view_title"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
-        android:layout_marginTop="@dimen/tile_view_title_margin_top"
+        android:layout_marginTop="@dimen/tile_view_title_margin_top_modern"
         android:ellipsize="end"
         android:gravity="center_horizontal"
         android:lines="2"

diff --git a/chrome/android/java/res/layout/tile_view_modern_condensed.xml b/chrome/android/java/res/layout/tile_view_modern_condensed.xml
index bbdb16d6e..30c7d85 100644
--- a/chrome/android/java/res/layout/tile_view_modern_condensed.xml
+++ b/chrome/android/java/res/layout/tile_view_modern_condensed.xml

@@ -16,7 +16,7 @@
         android:layout_width="@dimen/tile_view_icon_size"
         android:layout_height="@dimen/tile_view_icon_size"
         android:layout_gravity="center_horizontal"
-        android:layout_marginTop="@dimen/tile_view_icon_margin_top"
+        android:layout_marginTop="@dimen/tile_view_icon_background_margin_top_modern"
         android:background="@drawable/tile_view_icon_background_modern" />
 
     <!-- The main icon. -->
@@ -34,7 +34,7 @@
         android:layout_width="@dimen/tile_view_icon_size"
         android:layout_height="@dimen/tile_view_icon_size"
         android:layout_gravity="center_horizontal"
-        android:layout_marginTop="@dimen/tile_view_icon_margin_top"
+        android:layout_marginTop="@dimen/tile_view_icon_background_margin_top_modern"
         android:background="@drawable/tile_view_highlight" />
 
     <!-- The offline badge. -->
@@ -43,8 +43,8 @@
         android:layout_width="@dimen/tile_view_offline_badge_size_modern"
         android:layout_height="@dimen/tile_view_offline_badge_size_modern"
         android:layout_gravity="top|end"
-        android:layout_marginTop="@dimen/tile_view_offline_badge_margin_modern"
-        android:layout_marginEnd="@dimen/tile_view_offline_badge_margin_modern"
+        android:layout_marginTop="@dimen/tile_view_offline_badge_margin_top_modern_condensed"
+        android:layout_marginEnd="@dimen/tile_view_offline_badge_margin_end_modern_condensed"
         android:visibility="gone"
         android:contentDescription="@string/accessibility_ntp_offline_badge"
         chrome:chrometint="@color/tile_view_offline_badge_tint"
@@ -55,7 +55,7 @@
         android:id="@+id/tile_view_title"
         android:layout_width="match_parent"
         android:layout_height="wrap_content"
-        android:layout_marginTop="@dimen/tile_view_title_margin_top"
+        android:layout_marginTop="@dimen/tile_view_title_margin_top_modern"
         android:ellipsize="end"
         android:gravity="center_horizontal"
         android:lines="2"

diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index caea54c..63661447 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml

@@ -302,6 +302,7 @@
     <dimen name="tile_grid_layout_no_logo_padding_top">20dp</dimen>
     <dimen name="tile_grid_layout_bleed">8dp</dimen>
     <dimen name="tile_grid_layout_vertical_spacing">3dp</dimen>
+    <dimen name="tile_grid_layout_vertical_spacing_modern">6dp</dimen>
     <dimen name="tile_grid_layout_min_horizontal_spacing">4dp</dimen>
     <dimen name="tile_grid_layout_max_horizontal_spacing">16dp</dimen>
     <dimen name="tile_view_bg_corner_radius">2dp</dimen>
@@ -311,12 +312,17 @@
     <dimen name="tile_view_icon_size_modern">24dp</dimen>
     <dimen name="tile_view_icon_margin_top">12dp</dimen>
     <dimen name="tile_view_icon_margin_top_condensed">8dp</dimen>
-    <dimen name="tile_view_icon_margin_top_modern">24dp</dimen>
+    <dimen name="tile_view_icon_margin_top_modern">19dp</dimen>
+    <dimen name="tile_view_icon_background_margin_top_modern">7dp</dimen>
     <dimen name="tile_view_offline_badge_size">24dp</dimen>
     <dimen name="tile_view_offline_badge_size_modern">16dp</dimen>
-    <dimen name="tile_view_offline_badge_margin_modern">8dp</dimen>
+    <dimen name="tile_view_offline_badge_margin_top_modern">7dp</dimen>
+    <dimen name="tile_view_offline_badge_margin_end_modern">9dp</dimen>
+    <dimen name="tile_view_offline_badge_margin_top_modern_condensed">6dp</dimen>
+    <dimen name="tile_view_offline_badge_margin_end_modern_condensed">7dp</dimen>
     <dimen name="tile_view_title_margin_top">66dp</dimen>
     <dimen name="tile_view_title_margin_top_condensed">62dp</dimen>
+    <dimen name="tile_view_title_margin_top_modern">61dp</dimen>
     <dimen name="ntp_logo_height">116dp</dimen>
     <dimen name="ntp_logo_height_modern">30dp</dimen>
     <dimen name="ntp_logo_margin_top_modern">25dp</dimen>

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java
index 4099dc70..7913dab 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java

@@ -164,6 +164,9 @@
     public static final String ALWAYS_EXTRACT_WEBAPK_RUNTIME_DEX_ON_STARTUP =
             "always-extract-webapk-dex-on-startup";
 
+    /** Treats all WebAPKs as valid - useful only for local testing. */
+    public static final String SKIP_WEBAPK_VERIFICATION = "skip-webapk-verification";
+
     /**
      * Forces a check for whether the WebAPK's Web Manifest has changed each time that a WebAPK is
      * launched.

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/LayerTitleCache.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/LayerTitleCache.java
index 5ce00cf..182cb068 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/LayerTitleCache.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/LayerTitleCache.java

@@ -20,6 +20,7 @@
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.util.ColorUtils;
+import org.chromium.chrome.browser.util.FeatureUtilities;
 import org.chromium.ui.base.DeviceFormFactor;
 import org.chromium.ui.resources.ResourceManager;
 import org.chromium.ui.resources.dynamics.BitmapDynamicResource;
@@ -131,8 +132,10 @@
 
         ColorUtils.shouldUseLightForegroundOnBackground(tab.getThemeColor());
         boolean isRtl = tab.isTitleDirectionRtl();
-        TitleBitmapFactory titleBitmapFactory = isDarkTheme
-                ? mDarkTitleBitmapFactory : mStandardTitleBitmapFactory;
+        TitleBitmapFactory titleBitmapFactory =
+                isDarkTheme && !FeatureUtilities.isChromeHomeModernEnabled()
+                ? mDarkTitleBitmapFactory
+                : mStandardTitleBitmapFactory;
 
         Title title = mTitles.get(tabId);
         if (title == null) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanel.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanel.java
index 8402736..a2737df4 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanel.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/contextualsearch/ContextualSearchPanel.java

@@ -591,6 +591,8 @@
         mPanelMetrics.onSearchTermResolved();
         getSearchBarControl().setSearchTerm(searchTerm);
         getSearchBarControl().animateSearchTermResolution();
+        if (mActivity == null || mActivity.getToolbarManager() == null) return;
+
         getSearchBarControl().setQuickAction(quickActionUri, quickActionCategory,
                 mActivity.getToolbarManager().getPrimaryColor());
         getImageControl().setThumbnailUrl(thumbnailUrl);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java b/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java
index 16da9668..754584d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/infobar/IPHInfoBarSupport.java

@@ -137,6 +137,9 @@
     @Override
     public void onInfoBarContainerAttachedToWindow(boolean hasInfobars) {}
 
+    @Override
+    public void onInfoBarContainerShownRatioChanged(InfoBarContainer container, float shownRatio) {}
+
     // PopupWindow.OnDismissListener implementation.
     @Override
     public void onDismiss() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java b/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java
index 666f9d76..595787b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/infobar/InfoBarContainer.java

@@ -98,6 +98,13 @@
          * @param hasInfobars True if infobar container has infobars to show.
          */
         void onInfoBarContainerAttachedToWindow(boolean hasInfobars);
+
+        /**
+         * A notification that the shown ratio of the infobar container has changed.
+         * @param container The notifying {@link InfoBarContainer}
+         * @param shownRatio The shown ratio of the infobar container.
+         */
+        void onInfoBarContainerShownRatioChanged(InfoBarContainer container, float shownRatio);
     }
 
     /** Resets the state of the InfoBarContainer when the user navigates. */
@@ -240,6 +247,15 @@
     }
 
     @Override
+    public void setTranslationY(float translationY) {
+        super.setTranslationY(translationY);
+        float shownFraction = getHeight() > 0 ? 1f - (translationY / getHeight()) : 0;
+        for (InfoBarContainerObserver observer : mObservers) {
+            observer.onInfoBarContainerShownRatioChanged(this, shownFraction);
+        }
+    }
+
+    @Override
     public void setContentViewCore(ContentViewCore contentViewCore) {
         super.setContentViewCore(contentViewCore);
         if (getContentViewCore() != null) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/SignInPromo.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/SignInPromo.java
index 236927f..822b3f1f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/SignInPromo.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/cards/SignInPromo.java

@@ -334,8 +334,10 @@
                             ? R.layout.personalized_signin_promo_view_modern_content_suggestions
                             : R.layout.personalized_signin_promo_view_ntp_content_suggestions,
                     parent, config, contextMenuManager);
-            getParams().topMargin = parent.getResources().getDimensionPixelSize(
-                    R.dimen.ntp_sign_in_promo_margin_top);
+            if (!FeatureUtilities.isChromeHomeModernEnabled()) {
+                getParams().topMargin = parent.getResources().getDimensionPixelSize(
+                        R.dimen.ntp_sign_in_promo_margin_top);
+            }
 
             mProfileDataCache = profileDataCache;
             mSigninPromoController = signinPromoController;
@@ -405,8 +407,10 @@
         public GenericPromoViewHolder(SuggestionsRecyclerView parent,
                 ContextMenuManager contextMenuManager, UiConfig config) {
             super(parent, contextMenuManager, config);
-            getParams().topMargin = parent.getResources().getDimensionPixelSize(
-                    R.dimen.ntp_sign_in_promo_margin_top);
+            if (!FeatureUtilities.isChromeHomeModernEnabled()) {
+                getParams().topMargin = parent.getResources().getDimensionPixelSize(
+                        R.dimen.ntp_sign_in_promo_margin_top);
+            }
         }
 
         @DrawableRes

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java b/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java
index f519276f..9993b70 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java

@@ -175,6 +175,9 @@
     @Override
     public void onInfoBarContainerAttachedToWindow(boolean hasInfobars) {}
 
+    @Override
+    public void onInfoBarContainerShownRatioChanged(InfoBarContainer container, float shownRatio) {}
+
     /**
      * Temporarily changes the parent {@link ViewGroup} of the snackbar. If a snackbar is currently
      * showing, this method removes the snackbar from its original parent, and attaches it to the

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SiteSection.java b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SiteSection.java
index 9f4c761..69cd661 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SiteSection.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SiteSection.java

@@ -20,6 +20,7 @@
 import org.chromium.chrome.browser.suggestions.SiteSectionViewHolder.UpdateIconViewCallback;
 import org.chromium.chrome.browser.suggestions.SiteSectionViewHolder.UpdateOfflineBadgeCallback;
 import org.chromium.chrome.browser.suggestions.SiteSectionViewHolder.UpdateTilesCallback;
+import org.chromium.chrome.browser.util.FeatureUtilities;
 import org.chromium.chrome.browser.widget.displaystyle.UiConfig;
 
 /**
@@ -46,12 +47,8 @@
     private final TileRenderer mTileRenderer;
 
     public static ViewGroup inflateSiteSection(ViewGroup parent) {
-        @LayoutRes
-        int layoutResource =
-                SuggestionsConfig.useSitesExplorationUi() ? R.layout.suggestions_site_explore
-                                                          : R.layout.suggestions_site_tile_grid;
         return (ViewGroup) LayoutInflater.from(parent.getContext())
-                .inflate(layoutResource, parent, false);
+                .inflate(getLayout(), parent, false);
     }
 
     public static SiteSectionViewHolder createViewHolder(ViewGroup view) {
@@ -125,4 +122,15 @@
         return ChromeFeatureList.getFieldTrialParamByFeatureAsInt(
                 ChromeFeatureList.CHROME_HOME, PARAM_CHROME_HOME_TILE_TITLE_LINES, defaultValue);
     }
+
+    @LayoutRes
+    private static int getLayout() {
+        if (SuggestionsConfig.useSitesExplorationUi()) {
+            return R.layout.suggestions_site_explore;
+        }
+        if (FeatureUtilities.isChromeHomeModernEnabled()) {
+            return R.layout.suggestions_site_tile_grid_modern;
+        }
+        return R.layout.suggestions_site_tile_grid;
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsBottomSheetContent.java b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsBottomSheetContent.java
index 489d7db4..6e7211d6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsBottomSheetContent.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsBottomSheetContent.java

@@ -302,7 +302,7 @@
         // Context has changed, so we want to remove any old suggestions from the carousel.
         mSuggestionsCarousel.clearSuggestions();
 
-        String text = String.format(Locale.US, "Fetching contextual suggestions...");
+        String text = "Fetching contextual suggestions...";
         Toast.makeText(mRecyclerView.getContext(), text, Toast.LENGTH_SHORT).show();
         mSuggestionsUiDelegate.getSuggestionsSource().fetchContextualSuggestions(
                 url, new Callback<List<SnippetArticle>>() {
@@ -310,6 +310,9 @@
                     public void onResult(List<SnippetArticle> contextualSuggestions) {
                         mSuggestionsCarousel.newContextualSuggestionsAvailable(
                                 url, contextualSuggestions);
+                        String text = String.format(Locale.US, "Fetched %d contextual suggestions.",
+                                contextualSuggestions.size());
+                        Toast.makeText(mRecyclerView.getContext(), text, Toast.LENGTH_SHORT).show();
                     }
                 });
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/TileGridLayout.java b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/TileGridLayout.java
index 1a710868..5ffb9e8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/TileGridLayout.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/TileGridLayout.java

@@ -13,6 +13,7 @@
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.chrome.R;
+import org.chromium.chrome.browser.util.FeatureUtilities;
 import org.chromium.chrome.browser.util.MathUtils;
 
 import java.util.ArrayList;
@@ -44,7 +45,9 @@
         super(context, attrs);
 
         Resources res = getResources();
-        mVerticalSpacing = res.getDimensionPixelOffset(R.dimen.tile_grid_layout_vertical_spacing);
+        mVerticalSpacing = FeatureUtilities.isChromeHomeModernEnabled()
+                ? res.getDimensionPixelOffset(R.dimen.tile_grid_layout_vertical_spacing_modern)
+                : res.getDimensionPixelOffset(R.dimen.tile_grid_layout_vertical_spacing);
         mMinHorizontalSpacing =
                 res.getDimensionPixelOffset(R.dimen.tile_grid_layout_min_horizontal_spacing);
         mMaxHorizontalSpacing =

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarPhone.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarPhone.java
index 07d2dee9..41f91c3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarPhone.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarPhone.java

@@ -6,6 +6,7 @@
 
 import android.animation.Animator;
 import android.animation.ObjectAnimator;
+import android.animation.ValueAnimator;
 import android.content.Context;
 import android.content.res.ColorStateList;
 import android.content.res.Resources;
@@ -14,6 +15,7 @@
 import android.graphics.Rect;
 import android.graphics.drawable.Drawable;
 import android.graphics.drawable.GradientDrawable;
+import android.graphics.drawable.LayerDrawable;
 import android.os.SystemClock;
 import android.support.v4.graphics.drawable.DrawableCompat;
 import android.support.v7.widget.Toolbar;
@@ -28,7 +30,12 @@
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.appmenu.AppMenuButtonHelper;
 import org.chromium.chrome.browser.device.DeviceClassManager;
+import org.chromium.chrome.browser.infobar.InfoBar;
+import org.chromium.chrome.browser.infobar.InfoBarContainer;
+import org.chromium.chrome.browser.infobar.InfoBarContainer.InfoBarContainerObserver;
+import org.chromium.chrome.browser.tab.EmptyTabObserver;
 import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.tab.TabObserver;
 import org.chromium.chrome.browser.util.ColorUtils;
 import org.chromium.chrome.browser.util.FeatureUtilities;
 import org.chromium.chrome.browser.util.MathUtils;
@@ -135,6 +142,9 @@
                 }
             };
 
+    /** The time a transition for the top toolbar shadow should take in ms. */
+    private static final int DURATION_SHADOW_TRANSITION_MS = 250;
+
     /** The background alpha for the tab switcher. */
     private static final float TAB_SWITCHER_TOOLBAR_ALPHA = 0.7f;
 
@@ -218,6 +228,18 @@
      */
     private int mLocationBarExtraFocusedLeftMargin;
 
+    /** The top shadow drawable of the bottom toolbar if it exists. */
+    private LayerDrawable mBottomToolbarTopShadowDrawable;
+
+    /** Observer of the infobar container to change the toolbar shadow. */
+    private InfoBarContainerObserver mInfoBarContainerObserver;
+
+    /**
+     * A tab observer to attach/detach the {@link InfoBarContainerObserver} for the bottom toolbar
+     * top shadow.
+     */
+    private TabObserver mTopShadowTabObserver;
+
     /**
      * Constructs a BottomToolbarPhone object.
      * @param context The Context in which this View object is created.
@@ -240,6 +262,67 @@
         mUseModernDesign = true;
         mToolbarShadowPermanentlyHidden = true;
         mToolbarButtonVisibilityPercent = 1.f;
+
+        mInfoBarContainerObserver = new InfoBarContainerObserver() {
+            @Override
+            public void onAddInfoBar(InfoBarContainer c, InfoBar infoBar, boolean isFirst) {
+                if (!mUseModernDesign || !isFirst) return;
+                createShadowTransitionAnimator(1, 0).start();
+            }
+
+            @Override
+            public void onRemoveInfoBar(InfoBarContainer c, InfoBar infoBar, boolean isLast) {
+                if (!mUseModernDesign || !isLast) return;
+                createShadowTransitionAnimator(0, 1).start();
+            }
+
+            @Override
+            public void onInfoBarContainerAttachedToWindow(boolean hasInfobars) {}
+
+            @Override
+            public void onInfoBarContainerShownRatioChanged(InfoBarContainer c, float shownRatio) {
+                if (!mUseModernDesign || c.isAnimating()) return;
+                mBottomToolbarTopShadowDrawable.getDrawable(0).setAlpha(
+                        (int) (255 * (1 - shownRatio)));
+                mBottomToolbarTopShadowDrawable.getDrawable(1).setAlpha((int) (255 * shownRatio));
+            }
+        };
+
+        mTopShadowTabObserver = new EmptyTabObserver() {
+            @Override
+            public void onShown(Tab tab) {
+                if (!mUseModernDesign || tab.getInfoBarContainer() == null) return;
+                tab.getInfoBarContainer().addObserver(mInfoBarContainerObserver);
+            }
+
+            @Override
+            public void onHidden(Tab tab) {
+                if (!mUseModernDesign || tab.getInfoBarContainer() == null) return;
+                tab.getInfoBarContainer().removeObserver(mInfoBarContainerObserver);
+            }
+
+            @Override
+            public void onContentChanged(Tab tab) {
+                if (!mUseModernDesign || tab.getInfoBarContainer() == null) return;
+                tab.getInfoBarContainer().addObserver(mInfoBarContainerObserver);
+            }
+        };
+    }
+
+    /**
+     * Get the view and drawable for the bottom toolbar's top shadow and initialized the drawable
+     * state.
+     */
+    private void initBottomToolbarTopShadow() {
+        mBottomToolbarTopShadow =
+                (ImageView) getRootView().findViewById(R.id.bottom_toolbar_shadow);
+        mBottomToolbarTopShadowDrawable =
+                (LayerDrawable) getResources().getDrawable(R.drawable.bottom_toolbar_shadow);
+
+        mBottomToolbarTopShadowDrawable.getDrawable(0).setAlpha(255);
+        mBottomToolbarTopShadowDrawable.getDrawable(1).setAlpha(0);
+
+        mBottomToolbarTopShadow.setImageDrawable(mBottomToolbarTopShadowDrawable);
     }
 
     /**
@@ -303,6 +386,12 @@
         super.setTabSwitcherMode(inTabSwitcherMode, showToolbar, delayAnimation, animate);
         if (!mUseToolbarHandle) mExpandButton.setClickable(!inTabSwitcherMode);
         updateContentDescription();
+
+        // Reset top shadow drawable state.
+        if (mUseModernDesign && inTabSwitcherMode) {
+            mBottomToolbarTopShadowDrawable.getDrawable(0).setAlpha(255);
+            mBottomToolbarTopShadowDrawable.getDrawable(1).setAlpha(0);
+        }
     }
 
     @Override
@@ -312,6 +401,53 @@
     }
 
     @Override
+    protected void onTabOrModelChanged() {
+        super.onTabOrModelChanged();
+        attachShadowTabObserverToCurrentTab();
+    }
+
+    @Override
+    public void onStateRestored() {
+        super.onStateRestored();
+        attachShadowTabObserverToCurrentTab();
+    }
+
+    /**
+     * Attempt to attach the tab observer that controls the top shadow to the current tab.
+     */
+    private void attachShadowTabObserverToCurrentTab() {
+        if (!mUseModernDesign) return;
+
+        Tab currentTab = getToolbarDataProvider().getTab();
+        if (currentTab == null) return;
+
+        currentTab.addObserver(mTopShadowTabObserver);
+
+        if (currentTab.getInfoBarContainer() == null) return;
+        currentTab.getInfoBarContainer().addObserver(mInfoBarContainerObserver);
+    }
+
+    /**
+     * Create a transition animation for the top shadow.
+     * @param start The start opacity of the primary drawable (the shadow rather than the line).
+     * @param end The end opacity of the primary drawable.
+     * @return An {@link Animator} that runs the transition.
+     */
+    private Animator createShadowTransitionAnimator(float start, float end) {
+        ValueAnimator transition = ValueAnimator.ofFloat(start, end);
+        transition.setDuration(DURATION_SHADOW_TRANSITION_MS);
+        transition.addUpdateListener(new ValueAnimator.AnimatorUpdateListener() {
+            @Override
+            public void onAnimationUpdate(ValueAnimator valueAnimator) {
+                float value = (float) valueAnimator.getAnimatedValue();
+                mBottomToolbarTopShadowDrawable.getDrawable(0).setAlpha((int) (value * 255));
+                mBottomToolbarTopShadowDrawable.getDrawable(1).setAlpha((int) ((1 - value) * 255));
+            }
+        });
+        return transition;
+    }
+
+    @Override
     protected int getProgressBarColor() {
         int color = super.getProgressBarColor();
         if (getToolbarDataProvider().getTab() != null) {
@@ -620,8 +756,8 @@
         // own. Get the root view and search for the handle.
         mToolbarHandleView = (ImageView) getRootView().findViewById(R.id.toolbar_handle);
         mToolbarHandleView.setImageDrawable(mHandleDark);
-        mBottomToolbarTopShadow =
-                (ImageView) getRootView().findViewById(R.id.bottom_toolbar_shadow);
+
+        initBottomToolbarTopShadow();
 
         if (mToolbarShadowPermanentlyHidden) mToolbarShadow.setVisibility(View.GONE);
     }
@@ -661,6 +797,9 @@
         updateVisualsForToolbarState();
 
         mBottomToolbarTopShadow.setImageResource(R.drawable.toolbar_shadow);
+        if (mBottomToolbarTopShadowDrawable != null) {
+            mBottomToolbarTopShadowDrawable.setAlpha(0);
+        }
 
         invalidate();
         requestLayout();

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/webapps/ChromeWebApkHost.java b/chrome/android/java/src/org/chromium/chrome/browser/webapps/ChromeWebApkHost.java
index 4b0917b0..f7f6de5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/webapps/ChromeWebApkHost.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/webapps/ChromeWebApkHost.java

@@ -4,12 +4,16 @@
 
 package org.chromium.chrome.browser.webapps;
 
+import static org.chromium.chrome.browser.ChromeSwitches.SKIP_WEBAPK_VERIFICATION;
+
 import org.chromium.base.ApplicationState;
 import org.chromium.base.ApplicationStatus;
+import org.chromium.base.CommandLine;
 import org.chromium.base.ContextUtils;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.annotations.SuppressFBWarnings;
 import org.chromium.base.library_loader.LibraryLoader;
+import org.chromium.chrome.browser.ChromeVersionInfo;
 import org.chromium.webapk.lib.client.WebApkIdentityServiceClient;
 import org.chromium.webapk.lib.client.WebApkValidator;
 
@@ -22,6 +26,11 @@
     public static void init() {
         WebApkValidator.init(
                 ChromeWebApkHostSignature.EXPECTED_SIGNATURE, ChromeWebApkHostSignature.PUBLIC_KEY);
+        if (ChromeVersionInfo.isLocalBuild()
+                && CommandLine.getInstance().hasSwitch(SKIP_WEBAPK_VERIFICATION)) {
+            // Tell the WebApkValidator to work for all WebAPKs.
+            WebApkValidator.disableValidationForTesting();
+        }
     }
 
     /* Returns whether launching renderer in WebAPK process is enabled by Chrome. */

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/widget/ToolbarProgressBar.java b/chrome/android/java/src/org/chromium/chrome/browser/widget/ToolbarProgressBar.java
index 6743fa5..bf50ca94 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/widget/ToolbarProgressBar.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/widget/ToolbarProgressBar.java

@@ -170,6 +170,7 @@
         setAlpha(0.0f);
         mMarginTop = topMargin;
         mUseStatusBarColorAsBackground = useStatusBarColorAsBackground;
+        mAnimationLogic = new ProgressAnimationSmooth();
 
         // This tells accessibility services that progress bar changes are important enough to
         // announce to the user even when not focused.
@@ -231,7 +232,6 @@
         if (mAnimationInitialized) return;
 
         mAnimationInitialized = true;
-        mAnimationLogic = new ProgressAnimationSmooth();
 
         // Only use the indeterminate animation if the Android version is > J.
         if (Build.VERSION.SDK_INT > Build.VERSION_CODES.JELLY_BEAN_MR2) {

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java
index c4b9b2a..23f13a6 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabActivityTest.java

@@ -333,6 +333,18 @@
         return actualMenuSize;
     }
 
+    /**
+     * @return The number of visible items in the given menu.
+     */
+    private int getVisibleMenuSize(Menu menu) {
+        int visibleMenuSize = 0;
+        for (int i = 0; i < menu.size(); i++) {
+            MenuItem item = menu.getItem(i);
+            if (item.isVisible()) visibleMenuSize++;
+        }
+        return visibleMenuSize;
+    }
+
     private Bitmap createTestBitmap(int widthDp, int heightDp) {
         Resources testRes =
                 InstrumentationRegistry.getInstrumentation().getTargetContext().getResources();
@@ -527,10 +539,10 @@
         Menu menu =
                 mCustomTabActivityTestRule.getActivity().getAppMenuHandler().getAppMenu().getMenu();
         final int expectedMenuSize = numMenuEntries + NUM_CHROME_MENU_ITEMS;
-        final int actualMenuSize = getActualMenuSize(menu);
 
         Assert.assertNotNull("App menu is not initialized: ", menu);
-        Assert.assertEquals(expectedMenuSize, actualMenuSize);
+        Assert.assertEquals(expectedMenuSize, getActualMenuSize(menu));
+        Assert.assertEquals(expectedMenuSize, getVisibleMenuSize(menu));
         Assert.assertNotNull(menu.findItem(R.id.forward_menu_id));
         Assert.assertNotNull(menu.findItem(R.id.bookmark_this_page_id));
         Assert.assertNotNull(menu.findItem(R.id.offline_page_id));
@@ -561,14 +573,10 @@
         Menu menu =
                 mCustomTabActivityTestRule.getActivity().getAppMenuHandler().getAppMenu().getMenu();
         final int expectedMenuSize = 0;
-        final int actualMenuSize = getActualMenuSize(menu);
 
         Assert.assertNotNull("App menu is not initialized: ", menu);
-        Assert.assertEquals(expectedMenuSize, actualMenuSize);
-        Assert.assertFalse(menu.findItem(R.id.find_in_page_id).isVisible());
-        Assert.assertFalse(menu.findItem(R.id.add_to_homescreen_id).isVisible());
-        Assert.assertFalse(menu.findItem(R.id.request_desktop_site_row_menu_id).isVisible());
-        Assert.assertFalse(menu.findItem(R.id.open_in_browser_id).isVisible());
+        Assert.assertEquals(expectedMenuSize, getActualMenuSize(menu));
+        Assert.assertEquals(expectedMenuSize, getVisibleMenuSize(menu));
     }
 
     /**
@@ -587,10 +595,10 @@
         Menu menu =
                 mCustomTabActivityTestRule.getActivity().getAppMenuHandler().getAppMenu().getMenu();
         final int expectedMenuSize = 2;
-        final int actualMenuSize = getActualMenuSize(menu);
 
         Assert.assertNotNull("App menu is not initialized: ", menu);
-        Assert.assertEquals(expectedMenuSize, actualMenuSize);
+        Assert.assertEquals(expectedMenuSize, getActualMenuSize(menu));
+        Assert.assertEquals(expectedMenuSize, getVisibleMenuSize(menu));
         Assert.assertTrue(menu.findItem(R.id.find_in_page_id).isVisible());
         Assert.assertTrue(menu.findItem(R.id.reader_mode_prefs_id).isVisible());
     }
@@ -623,6 +631,7 @@
     public void testMaxMenuItems() throws InterruptedException {
         Intent intent = createMinimalCustomTabIntent();
         int numMenuEntries = 7;
+        Assert.assertTrue(MAX_MENU_CUSTOM_ITEMS < numMenuEntries);
         addMenuEntriesToIntent(intent, numMenuEntries);
         mCustomTabActivityTestRule.startCustomTabActivityWithIntent(intent);
 
@@ -630,9 +639,9 @@
         Menu menu =
                 mCustomTabActivityTestRule.getActivity().getAppMenuHandler().getAppMenu().getMenu();
         final int expectedMenuSize = MAX_MENU_CUSTOM_ITEMS + NUM_CHROME_MENU_ITEMS;
-        final int actualMenuSize = getActualMenuSize(menu);
         Assert.assertNotNull("App menu is not initialized: ", menu);
-        Assert.assertEquals(expectedMenuSize, actualMenuSize);
+        Assert.assertEquals(expectedMenuSize, getActualMenuSize(menu));
+        Assert.assertEquals(expectedMenuSize, getVisibleMenuSize(menu));
     }
 
     /**

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/dom_distiller/DistillabilityServiceTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/dom_distiller/DistillabilityServiceTest.java
index 7794b9e0..8840e9c 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/dom_distiller/DistillabilityServiceTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/dom_distiller/DistillabilityServiceTest.java

@@ -78,6 +78,10 @@
 
             @Override
             public void onInfoBarContainerAttachedToWindow(boolean hasInfobars) {}
+
+            @Override
+            public void onInfoBarContainerShownRatioChanged(
+                    InfoBarContainer container, float shownRatio) {}
         });
 
         TestWebContentsObserver observer = new TestWebContentsObserver(

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionStatsPreferenceTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionStatsPreferenceTest.java
index d69774b4..397b336 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionStatsPreferenceTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionStatsPreferenceTest.java

@@ -95,7 +95,9 @@
     @Feature({"DataReduction"})
     public void testDontInitializeSiteBreakdownPref() throws Throwable {
         // Disable the feature
-        ChromeFeatureList.setTestFeatures(null);
+        Map<String, Boolean> features = new HashMap<>();
+        features.put(ChromeFeatureList.DATA_REDUCTION_SITE_BREAKDOWN, false);
+        ChromeFeatureList.setTestFeatures(features);
 
         DataReductionStatsPreference.initializeDataReductionSiteBreakdownPref();
         Assert.assertFalse(ContextUtils.getAppSharedPreferences().contains(

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/WebVrTransitionTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/WebVrTransitionTest.java
index ca65689..318e030 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/WebVrTransitionTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/vr_shell/WebVrTransitionTest.java

@@ -25,6 +25,7 @@
 import org.chromium.base.test.params.ParameterSet;
 import org.chromium.base.test.params.ParameterizedRunner;
 import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.MinAndroidSdkLevel;
 import org.chromium.base.test.util.Restriction;
 import org.chromium.chrome.browser.ChromeActivity;
@@ -147,6 +148,7 @@
     @MediumTest
     @CommandLineFlags.Add("enable-features=WebVrAutopresent")
     @Restriction(RESTRICTION_TYPE_VIEWER_DAYDREAM)
+    @DisabledTest(message = "Doesn't work anymore until autopresent isn't forced into CCT")
     public void testTrustedIntentAllowsAutoPresent() throws InterruptedException {
         VrIntentUtils.setHandlerInstanceForTesting(new MockVrIntentHandler(
                 true /* useMockImplementation */, true /* treatIntentsAsTrusted */));

diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/suggestions/TileGroupUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/suggestions/TileGroupUnitTest.java
index 4198939..166e9d4c 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/suggestions/TileGroupUnitTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/suggestions/TileGroupUnitTest.java

@@ -39,6 +39,7 @@
 import org.robolectric.RuntimeEnvironment;
 import org.robolectric.annotation.Config;
 
+import org.chromium.base.ContextUtils;
 import org.chromium.chrome.browser.ChromeFeatureList;
 import org.chromium.chrome.browser.favicon.LargeIconBridge.LargeIconCallback;
 import org.chromium.chrome.browser.ntp.ContextMenuManager;
@@ -59,6 +60,7 @@
 @RunWith(LocalRobolectricTestRunner.class)
 @Config(manifest = Config.NONE)
 @Features({@Features.Register(ChromeFeatureList.NTP_OFFLINE_PAGES_FEATURE_NAME),
+        @Features.Register(ChromeFeatureList.CHROME_HOME),
         @Features.Register(ChromeFeatureList.CHROME_HOME_MODERN_LAYOUT),
         @Features.Register(ChromeFeatureList.NTP_TILES_LOWER_RESOLUTION_FAVICONS)})
 public class TileGroupUnitTest {
@@ -82,6 +84,7 @@
     public void setUp() {
         CardsVariationParameters.setTestVariationParams(new HashMap<>());
         MockitoAnnotations.initMocks(this);
+        ContextUtils.initApplicationContextForTests(RuntimeEnvironment.application);
 
         mImageFetcher = new FakeImageFetcher();
         mTileRenderer = new TileRenderer(

diff --git a/chrome/android/webapk/libs/client/src/org/chromium/webapk/lib/client/WebApkValidator.java b/chrome/android/webapk/libs/client/src/org/chromium/webapk/lib/client/WebApkValidator.java
index 2fc1e46..cde3292d 100644
--- a/chrome/android/webapk/libs/client/src/org/chromium/webapk/lib/client/WebApkValidator.java
+++ b/chrome/android/webapk/libs/client/src/org/chromium/webapk/lib/client/WebApkValidator.java

@@ -43,6 +43,7 @@
     private static byte[] sExpectedSignature;
     private static byte[] sCommentSignedPublicKeyBytes;
     private static PublicKey sCommentSignedPublicKey;
+    private static boolean sOverrideValidationForTesting;
 
     /**
      * Queries the PackageManager to determine whether a WebAPK can handle the URL. Ignores whether
@@ -176,6 +177,10 @@
         if (isNotWebApkQuick(packageInfo)) {
             return false;
         }
+        if (sOverrideValidationForTesting) {
+            Log.d(TAG, "Ok! Looks like a WebApk (has start url) and validation is disabled.");
+            return true;
+        }
         if (verifyV1WebApk(packageInfo, webappPackageName)) {
             return true;
         }
@@ -287,6 +292,14 @@
     }
 
     /**
+     * Disables all verification performed by this class. This is meant only for development with
+     * unsigned WebApks and should never be enabled in a real build.
+     */
+    public static void disableValidationForTesting() {
+        sOverrideValidationForTesting = true;
+    }
+
+    /**
      * Lazy evaluate the creation of the Public Key as the KeyFactories may not yet be initialized.
      * @return The decoded PublicKey or null
      */

diff --git a/chrome/app/resources/locale_settings.grd b/chrome/app/resources/locale_settings.grd
index a9754a6..3ed6c81 100644
--- a/chrome/app/resources/locale_settings.grd
+++ b/chrome/app/resources/locale_settings.grd

@@ -202,11 +202,6 @@
         50
       </message>
 
-      <!-- The URL for the the Welcome to Chrome page shown on first run. -->
-      <message name="IDS_WELCOME_PAGE_URL" translateable="false">
-        https://www.google.com/intl/[GRITLANGCODE]/chrome/browser/welcome.html
-      </message>
-
       <!-- The language dependent download view size. -->
       <message name="IDS_DOWNLOAD_BIG_PROGRESS_SIZE" use_name_for_id="true">
         52

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index c5ba7593..e4baad6 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -3433,6 +3433,12 @@
      SINGLE_VALUE_TYPE(chromeos::switches::kEnableExternalDriveRename)},
 #endif  // defined(OS_CHROMEOS)
 
+#if defined(OS_CHROMEOS)
+    {"sys-internals", flag_descriptions::kSysInternalsName,
+     flag_descriptions::kSysInternalsDescription, kOsCrOS,
+     FEATURE_VALUE_TYPE(features::kSysInternals)}
+#endif  // defined(OS_CHROMEOS)
+
     // NOTE: Adding new command-line switches requires adding corresponding
     // entries to enum "LoginCustomFlags" in histograms/enums.xml. See note in
     // enums.xml and don't forget to run AboutFlagsHistogramTest unit test.

diff --git a/chrome/browser/after_startup_task_utils.cc b/chrome/browser/after_startup_task_utils.cc
index 5189dd4..8e8071b 100644
--- a/chrome/browser/after_startup_task_utils.cc
+++ b/chrome/browser/after_startup_task_utils.cc

@@ -7,6 +7,7 @@
 #include <memory>
 #include <utility>
 
+#include "base/containers/circular_deque.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
@@ -48,7 +49,8 @@
 base::LazyInstance<base::AtomicFlag>::Leaky g_startup_complete_flag;
 
 // The queue may only be accessed on the UI thread.
-base::LazyInstance<std::deque<AfterStartupTask*>>::Leaky g_after_startup_tasks;
+base::LazyInstance<base::circular_deque<AfterStartupTask*>>::Leaky
+    g_after_startup_tasks;
 
 bool IsBrowserStartupComplete() {
   // Be sure to initialize the LazyInstance on the main thread since the flag
@@ -117,7 +119,7 @@
   g_after_startup_tasks.Get().clear();
 
   // The shrink_to_fit() method is not available for all of our build targets.
-  std::deque<AfterStartupTask*>(g_after_startup_tasks.Get())
+  base::circular_deque<AfterStartupTask*>(g_after_startup_tasks.Get())
       .swap(g_after_startup_tasks.Get());
 }
 

diff --git a/chrome/browser/android/data_usage/tab_data_use_entry.h b/chrome/browser/android/data_usage/tab_data_use_entry.h
index 6b362ee7..27ef9ab1 100644
--- a/chrome/browser/android/data_usage/tab_data_use_entry.h
+++ b/chrome/browser/android/data_usage/tab_data_use_entry.h

@@ -8,6 +8,7 @@
 #include <string>
 #include <vector>
 
+#include "base/containers/circular_deque.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/time/time.h"
@@ -107,11 +108,7 @@
                            ExpiredInactiveTabEntryRemovaltimeHistogram);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, TabCloseEvent);
 
-  // This is a std::vector instead of a std::deque because std::deque is
-  // inefficient for small numbers of elements (see crbug/674287). By default,
-  // at most 5 sessions are tracked at a time per tab, so erasing from the front
-  // of the vector is cheap anyways.
-  typedef std::vector<TabDataUseTrackingSession> TabSessions;
+  using TabSessions = base::circular_deque<TabDataUseTrackingSession>;
 
   // Compacts the history of tracking sessions by removing oldest sessions to
   // keep the size of |sessions_| within |kMaxSessionsPerTab| entries.

diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resources.grd
index e048b8cc..f9a61646 100644
--- a/chrome/browser/browser_resources.grd
+++ b/chrome/browser/browser_resources.grd

@@ -677,6 +677,11 @@
       <include name="IDR_MEDIA_ENGAGEMENT_HTML" file="resources\media\media_engagement.html" flattenhtml="true" type="BINDATA" compress="gzip" allowexternalscript="true" />
       <include name="IDR_MEDIA_ENGAGEMENT_JS" file="resources\media\media_engagement.js" flattenhtml="true" type="BINDATA" compress="gzip" />
       <include name="IDR_MEDIA_ENGAGEMENT_MOJO_JS" file="${root_gen_dir}\chrome\browser\media\media_engagement_score_details.mojom.js" use_base_dir="false" type="BINDATA" compress="gzip" />
+      <if expr="chromeos">
+        <include name="IDR_SYS_INTERNALS_HTML" file="resources\sys_internals\index.html" type="BINDATA" />
+        <include name="IDR_SYS_INTERNALS_CSS" file="resources\sys_internals\index.css" type="BINDATA" />
+        <include name="IDR_SYS_INTERNALS_JS" file="resources\sys_internals\index.js" flattenhtml="true" type="BINDATA" />
+      </if>
     </includes>
   </release>
 </grit>

diff --git a/chrome/browser/browsing_data/canonical_cookie_hash.cc b/chrome/browser/browsing_data/canonical_cookie_hash.cc
index 218555e..7cb590e 100644
--- a/chrome/browser/browsing_data/canonical_cookie_hash.cc
+++ b/chrome/browser/browsing_data/canonical_cookie_hash.cc

@@ -9,10 +9,9 @@
 namespace canonical_cookie {
 
 size_t FastHash(const net::CanonicalCookie& cookie) {
-  return base::SuperFastHash(cookie.Name().c_str(), cookie.Name().size()) +
-         3 * base::SuperFastHash(cookie.Domain().c_str(),
-                                 cookie.Domain().size()) +
-         7 * base::SuperFastHash(cookie.Path().c_str(), cookie.Path().size());
+  return base::PersistentHash(cookie.Name()) +
+         3 * base::PersistentHash(cookie.Domain()) +
+         7 * base::PersistentHash(cookie.Path());
 }
 
-};  // namespace canonical_cookie
+}  // namespace canonical_cookie

diff --git a/chrome/browser/browsing_data/canonical_cookie_hash.h b/chrome/browser/browsing_data/canonical_cookie_hash.h
index cd7d6afb..066c388c 100644
--- a/chrome/browser/browsing_data/canonical_cookie_hash.h
+++ b/chrome/browser/browsing_data/canonical_cookie_hash.h

@@ -38,6 +38,6 @@
                        CanonicalCookieHasher,
                        CanonicalCookieComparer> CookieHashSet;
 
-};  // namespace canonical_cookie
+}  // namespace canonical_cookie
 
 #endif  // CHROME_BROWSER_BROWSING_DATA_CANONICAL_COOKIE_HASH_H_

diff --git a/chrome/browser/certificate_manager_model.cc b/chrome/browser/certificate_manager_model.cc
index bab0ffae..1cf49d7 100644
--- a/chrome/browser/certificate_manager_model.cc
+++ b/chrome/browser/certificate_manager_model.cc

@@ -22,6 +22,7 @@
 #include "crypto/nss_util.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
+#include "net/cert/x509_util_nss.h"
 #include "ui/base/l10n/l10n_util.h"
 
 // TODO(wychen): ChromeOS headers should only be included when building
@@ -61,14 +62,13 @@
 
 namespace {
 
-std::string GetCertificateOrg(net::X509Certificate* cert) {
-    std::string org;
-    if (!cert->subject().organization_names.empty())
-      org = cert->subject().organization_names[0];
-    if (org.empty())
-      org = cert->subject().GetDisplayName();
+std::string GetCertificateOrg(CERTCertificate* cert) {
+  std::string org =
+      x509_certificate_model::GetSubjectOrgName(cert, std::string());
+  if (org.empty())
+    org = x509_certificate_model::GetSubjectDisplayName(cert);
 
-    return org;
+  return org;
 }
 
 }  // namespace
@@ -137,7 +137,7 @@
 void CertificateManagerModel::RefreshSlotsUnlocked() {
   DVLOG(1) << "refresh listing certs...";
   // TODO(tbarzic): Use async |ListCerts|.
-  cert_db_->ListCertsSync(&cert_list_);
+  cert_list_ = cert_db_->ListCertsSync();
   observer_->CertificatesRefreshed();
   DVLOG(1) << "refresh finished for platform provided certificates";
 }
@@ -146,8 +146,13 @@
     net::ClientCertIdentityList new_cert_identities) {
   extension_cert_list_.clear();
   extension_cert_list_.reserve(new_cert_identities.size());
-  for (const auto& identity : new_cert_identities)
-    extension_cert_list_.push_back(identity->certificate());
+  for (const auto& identity : new_cert_identities) {
+    net::ScopedCERTCertificate nss_cert(
+        net::x509_util::CreateCERTCertificateFromX509Certificate(
+            identity->certificate()));
+    if (nss_cert)
+      extension_cert_list_.push_back(std::move(nss_cert));
+  }
   observer_->CertificatesRefreshed();
   DVLOG(1) << "refresh finished for extension provided certificates";
 }
@@ -155,42 +160,41 @@
 void CertificateManagerModel::FilterAndBuildOrgGroupingMap(
     net::CertType filter_type,
     CertificateManagerModel::OrgGroupingMap* map) const {
-  for (net::CertificateList::const_iterator i = cert_list_.begin();
-       i != cert_list_.end(); ++i) {
-    net::X509Certificate* cert = i->get();
-    net::CertType type =
-        x509_certificate_model::GetType(cert->os_cert_handle());
+  for (const net::ScopedCERTCertificate& cert : cert_list_) {
+    net::CertType type = x509_certificate_model::GetType(cert.get());
     if (type != filter_type)
       continue;
 
-    std::string org = GetCertificateOrg(cert);
-    (*map)[org].push_back(cert);
+    std::string org = GetCertificateOrg(cert.get());
+    (*map)[org].push_back(net::x509_util::DupCERTCertificate(cert.get()));
   }
 
   // Display extension provided certificates under the "Your Certificates" tab.
   if (filter_type == net::USER_CERT) {
     for (const auto& cert : extension_cert_list_) {
       std::string org = GetCertificateOrg(cert.get());
-      (*map)[org].push_back(cert);
+      (*map)[org].push_back(net::x509_util::DupCERTCertificate(cert.get()));
     }
   }
 }
 
-base::string16 CertificateManagerModel::GetColumnText(
-    const net::X509Certificate& cert,
-    Column column) const {
+base::string16 CertificateManagerModel::GetColumnText(CERTCertificate* cert,
+                                                      Column column) const {
   base::string16 rv;
   switch (column) {
     case COL_SUBJECT_NAME:
       rv = base::UTF8ToUTF16(
-          x509_certificate_model::GetCertNameOrNickname(cert.os_cert_handle()));
+          x509_certificate_model::GetCertNameOrNickname(cert));
 
       // Mark extension provided certificates.
-      if (base::ContainsValue(extension_cert_list_, &cert)) {
+      if (std::find_if(extension_cert_list_.begin(), extension_cert_list_.end(),
+                       [cert](const net::ScopedCERTCertificate& element) {
+                         return element.get() == cert;
+                       }) != extension_cert_list_.end()) {
         rv = l10n_util::GetStringFUTF16(
             IDS_CERT_MANAGER_EXTENSION_PROVIDED_FORMAT,
             rv);
-      } else if (IsHardwareBacked(&cert)) {
+      } else if (IsHardwareBacked(cert)) {
         // TODO(xiyuan): Put this into a column when we have js tree-table.
         rv = l10n_util::GetStringFUTF16(
             IDS_CERT_MANAGER_HARDWARE_BACKED_KEY_FORMAT,
@@ -199,17 +203,18 @@
       }
       break;
     case COL_CERTIFICATE_STORE:
-      rv = base::UTF8ToUTF16(
-          x509_certificate_model::GetTokenName(cert.os_cert_handle()));
+      rv = base::UTF8ToUTF16(x509_certificate_model::GetTokenName(cert));
       break;
     case COL_SERIAL_NUMBER:
-      rv = base::ASCIIToUTF16(x509_certificate_model::GetSerialNumberHexified(
-          cert.os_cert_handle(), std::string()));
+      rv = base::ASCIIToUTF16(
+          x509_certificate_model::GetSerialNumberHexified(cert, std::string()));
       break;
-    case COL_EXPIRES_ON:
-      if (!cert.valid_expiry().is_null())
-        rv = base::TimeFormatShortDateNumeric(cert.valid_expiry());
+    case COL_EXPIRES_ON: {
+      base::Time not_before, not_after;
+      if (net::x509_util::GetValidityTimes(cert, &not_before, &not_after))
+        rv = base::TimeFormatShortDateNumeric(not_after);
       break;
+    }
     default:
       NOTREACHED();
   }
@@ -235,42 +240,43 @@
 }
 
 bool CertificateManagerModel::ImportCACerts(
-    const net::CertificateList& certificates,
+    const net::ScopedCERTCertificateList& certificates,
     net::NSSCertDatabase::TrustBits trust_bits,
     net::NSSCertDatabase::ImportCertFailureList* not_imported) {
+  const size_t num_certs = certificates.size();
   bool result = cert_db_->ImportCACerts(certificates, trust_bits, not_imported);
-  if (result && not_imported->size() != certificates.size())
+  if (result && not_imported->size() != num_certs)
     Refresh();
   return result;
 }
 
 bool CertificateManagerModel::ImportServerCert(
-    const net::CertificateList& certificates,
+    const net::ScopedCERTCertificateList& certificates,
     net::NSSCertDatabase::TrustBits trust_bits,
     net::NSSCertDatabase::ImportCertFailureList* not_imported) {
-  bool result = cert_db_->ImportServerCert(certificates, trust_bits,
-                                           not_imported);
-  if (result && not_imported->size() != certificates.size())
+  const size_t num_certs = certificates.size();
+  bool result =
+      cert_db_->ImportServerCert(certificates, trust_bits, not_imported);
+  if (result && not_imported->size() != num_certs)
     Refresh();
   return result;
 }
 
 bool CertificateManagerModel::SetCertTrust(
-    const net::X509Certificate* cert,
+    CERTCertificate* cert,
     net::CertType type,
     net::NSSCertDatabase::TrustBits trust_bits) {
   return cert_db_->SetCertTrust(cert, type, trust_bits);
 }
 
-bool CertificateManagerModel::Delete(net::X509Certificate* cert) {
+bool CertificateManagerModel::Delete(CERTCertificate* cert) {
   bool result = cert_db_->DeleteCertAndKey(cert);
   if (result)
     Refresh();
   return result;
 }
 
-bool CertificateManagerModel::IsHardwareBacked(
-    const net::X509Certificate* cert) const {
+bool CertificateManagerModel::IsHardwareBacked(CERTCertificate* cert) const {
   return cert_db_->IsHardwareBacked(cert);
 }
 

diff --git a/chrome/browser/certificate_manager_model.h b/chrome/browser/certificate_manager_model.h
index 191ab87..10c216bf 100644
--- a/chrome/browser/certificate_manager_model.h
+++ b/chrome/browser/certificate_manager_model.h

@@ -15,6 +15,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/strings/string16.h"
 #include "net/cert/nss_cert_database.h"
+#include "net/cert/scoped_nss_types.h"
 #include "net/ssl/client_cert_identity.h"
 
 namespace chromeos {
@@ -33,7 +34,7 @@
   // Map from the subject organization name to the list of certs from that
   // organization.  If a cert does not have an organization name, the
   // subject's CertPrincipal::GetDisplayName() value is used instead.
-  typedef std::map<std::string, net::CertificateList> OrgGroupingMap;
+  typedef std::map<std::string, net::ScopedCERTCertificateList> OrgGroupingMap;
 
   typedef base::Callback<void(std::unique_ptr<CertificateManagerModel>)>
       CreationCallback;
@@ -80,7 +81,7 @@
                                     OrgGroupingMap* map) const;
 
   // Get the data to be displayed in |column| for the given |cert|.
-  base::string16 GetColumnText(const net::X509Certificate& cert, Column column) const;
+  base::string16 GetColumnText(CERTCertificate* cert, Column column) const;
 
   // Import private keys and certificates from PKCS #12 encoded
   // |data|, using the given |password|. If |is_extractable| is false,
@@ -101,7 +102,7 @@
   // Returns false if there is an internal error, otherwise true is returned and
   // |not_imported| should be checked for any certificates that were not
   // imported.
-  bool ImportCACerts(const net::CertificateList& certificates,
+  bool ImportCACerts(const net::ScopedCERTCertificateList& certificates,
                      net::NSSCertDatabase::TrustBits trust_bits,
                      net::NSSCertDatabase::ImportCertFailureList* not_imported);
 
@@ -116,23 +117,23 @@
   // |not_imported| should be checked for any certificates that were not
   // imported.
   bool ImportServerCert(
-      const net::CertificateList& certificates,
+      const net::ScopedCERTCertificateList& certificates,
       net::NSSCertDatabase::TrustBits trust_bits,
       net::NSSCertDatabase::ImportCertFailureList* not_imported);
 
   // Set trust values for certificate.
   // |trust_bits| should be a bit field of TRUST* values from NSSCertDatabase.
   // Returns true on success or false on failure.
-  bool SetCertTrust(const net::X509Certificate* cert,
+  bool SetCertTrust(CERTCertificate* cert,
                     net::CertType type,
                     net::NSSCertDatabase::TrustBits trust_bits);
 
   // Delete the cert.  Returns true on success.  |cert| is still valid when this
   // function returns.
-  bool Delete(net::X509Certificate* cert);
+  bool Delete(CERTCertificate* cert);
 
   // IsHardwareBacked returns true if |cert| is hardware backed.
-  bool IsHardwareBacked(const net::X509Certificate* cert) const;
+  bool IsHardwareBacked(CERTCertificate* cert) const;
 
  private:
   CertificateManagerModel(
@@ -175,8 +176,8 @@
       net::ClientCertIdentityList new_cert_identities);
 
   net::NSSCertDatabase* cert_db_;
-  net::CertificateList cert_list_;
-  net::CertificateList extension_cert_list_;
+  net::ScopedCERTCertificateList cert_list_;
+  net::ScopedCERTCertificateList extension_cert_list_;
   // Whether the certificate database has a public slot associated with the
   // profile. If not set, importing certificates is not allowed with this model.
   bool is_user_db_available_;

diff --git a/chrome/browser/chrome_browser_main_win.cc b/chrome/browser/chrome_browser_main_win.cc
index 8dc50de..a7c305f 100644
--- a/chrome/browser/chrome_browser_main_win.cc
+++ b/chrome/browser/chrome_browser_main_win.cc

@@ -90,7 +90,7 @@
 
 void InitializeWindowProcExceptions() {
   base::win::WinProcExceptionFilter exception_filter =
-      base::win::SetWinProcExceptionFilter(&CrashForException);
+      base::win::SetWinProcExceptionFilter(&CrashForException_ExportThunk);
   DCHECK(!exception_filter);
 }
 

diff --git a/chrome/browser/chromeos/accessibility/accessibility_manager.cc b/chrome/browser/chromeos/accessibility/accessibility_manager.cc
index 293bd49..36c4460e 100644
--- a/chrome/browser/chromeos/accessibility/accessibility_manager.cc
+++ b/chrome/browser/chromeos/accessibility/accessibility_manager.cc

@@ -13,7 +13,6 @@
 #include "ash/accessibility/accessibility_controller.h"
 #include "ash/autoclick/autoclick_controller.h"
 #include "ash/autoclick/mus/public/interfaces/autoclick.mojom.h"
-#include "ash/high_contrast/high_contrast_controller.h"
 #include "ash/public/cpp/ash_pref_names.h"
 #include "ash/root_window_controller.h"
 #include "ash/shelf/shelf.h"
@@ -247,7 +246,6 @@
           ash::prefs::kAccessibilitySwitchAccessEnabled),
       sticky_keys_enabled_(false),
       spoken_feedback_enabled_(false),
-      high_contrast_enabled_(false),
       autoclick_enabled_(false),
       autoclick_delay_ms_(ash::AutoclickController::GetDefaultAutoclickDelay()),
       virtual_keyboard_enabled_(false),
@@ -517,32 +515,16 @@
   pref_service->CommitPendingWrite();
 }
 
-void AccessibilityManager::UpdateHighContrastFromPref() {
-  if (!profile_)
-    return;
+bool AccessibilityManager::IsHighContrastEnabled() const {
+  return profile_ && profile_->GetPrefs()->GetBoolean(
+                         ash::prefs::kAccessibilityHighContrastEnabled);
+}
 
-  PrefService* prefs = profile_->GetPrefs();
-  const bool enabled =
-      prefs->GetBoolean(ash::prefs::kAccessibilityHighContrastEnabled);
-
-  if (high_contrast_enabled_ == enabled)
-    return;
-
-  high_contrast_enabled_ = enabled;
-
+void AccessibilityManager::OnHighContrastChanged() {
   AccessibilityStatusEventDetails details(
-      ACCESSIBILITY_TOGGLE_HIGH_CONTRAST_MODE, enabled,
+      ACCESSIBILITY_TOGGLE_HIGH_CONTRAST_MODE, IsHighContrastEnabled(),
       ash::A11Y_NOTIFICATION_NONE);
-
   NotifyAccessibilityStatusChanged(details);
-
-  // TODO(crbug.com/594887): Fix for mash by moving pref into ash.
-  if (GetAshConfig() == ash::Config::MASH)
-    return;
-
-  ash::Shell::Get()->high_contrast_controller()->SetEnabled(enabled);
-  ash::Shell::Get()->SetCursorCompositingEnabled(
-      ash::AccessibilityController::RequiresCursorCompositing(prefs));
 }
 
 void AccessibilityManager::OnLocaleChanged() {
@@ -665,10 +647,6 @@
     rwc->SetTouchAccessibilityAnchorPoint(anchor_point);
 }
 
-bool AccessibilityManager::IsHighContrastEnabled() const {
-  return high_contrast_enabled_;
-}
-
 void AccessibilityManager::EnableAutoclick(bool enabled) {
   if (!profile_)
     return;
@@ -1178,7 +1156,7 @@
                    base::Unretained(this)));
     pref_change_registrar_->Add(
         ash::prefs::kAccessibilityHighContrastEnabled,
-        base::Bind(&AccessibilityManager::UpdateHighContrastFromPref,
+        base::Bind(&AccessibilityManager::OnHighContrastChanged,
                    base::Unretained(this)));
     pref_change_registrar_->Add(
         ash::prefs::kAccessibilityAutoclickEnabled,
@@ -1264,7 +1242,6 @@
   UpdateAlwaysShowMenuFromPref();
   UpdateStickyKeysFromPref();
   UpdateSpokenFeedbackFromPref();
-  UpdateHighContrastFromPref();
   UpdateAutoclickFromPref();
   UpdateAutoclickDelayFromPref();
   UpdateVirtualKeyboardFromPref();

diff --git a/chrome/browser/chromeos/accessibility/accessibility_manager.h b/chrome/browser/chromeos/accessibility/accessibility_manager.h
index 518cca98..da294e24 100644
--- a/chrome/browser/chromeos/accessibility/accessibility_manager.h
+++ b/chrome/browser/chromeos/accessibility/accessibility_manager.h

@@ -316,7 +316,7 @@
   void OnLargeCursorChanged();
   void UpdateStickyKeysFromPref();
   void UpdateSpokenFeedbackFromPref();
-  void UpdateHighContrastFromPref();
+  void OnHighContrastChanged();
   void UpdateAutoclickFromPref();
   void UpdateAutoclickDelayFromPref();
   void UpdateVirtualKeyboardFromPref();
@@ -392,7 +392,6 @@
 
   bool sticky_keys_enabled_;
   bool spoken_feedback_enabled_;
-  bool high_contrast_enabled_;
   bool autoclick_enabled_;
   base::TimeDelta autoclick_delay_ms_;
   bool virtual_keyboard_enabled_;

diff --git a/chrome/browser/chromeos/accessibility/speech_monitor.h b/chrome/browser/chromeos/accessibility/speech_monitor.h
index 86c4262..3512ed9c 100644
--- a/chrome/browser/chromeos/accessibility/speech_monitor.h
+++ b/chrome/browser/chromeos/accessibility/speech_monitor.h

@@ -5,8 +5,7 @@
 #ifndef CHROME_BROWSER_CHROMEOS_ACCESSIBILITY_SPEECH_MONITOR_H_
 #define CHROME_BROWSER_CHROMEOS_ACCESSIBILITY_SPEECH_MONITOR_H_
 
-#include <deque>
-
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "chrome/browser/speech/tts_platform.h"
@@ -53,7 +52,7 @@
                                    const VoiceData& voice_data) override;
 
   scoped_refptr<content::MessageLoopRunner> loop_runner_;
-  std::deque<std::string> utterance_queue_;
+  base::circular_deque<std::string> utterance_queue_;
   bool did_stop_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(SpeechMonitor);

diff --git a/chrome/browser/chromeos/arc/accessibility/arc_accessibility_helper_bridge_unittest.cc b/chrome/browser/chromeos/arc/accessibility/arc_accessibility_helper_bridge_unittest.cc
index b8655a1..353f722 100644
--- a/chrome/browser/chromeos/arc/accessibility/arc_accessibility_helper_bridge_unittest.cc
+++ b/chrome/browser/chromeos/arc/accessibility/arc_accessibility_helper_bridge_unittest.cc

@@ -50,6 +50,7 @@
     void AddPostTargetHandler(ui::EventHandler* handler) override {}
     void RemovePostTargetHandler(ui::EventHandler* handler) override {}
     bool IsTabletModeWindowManagerEnabled() const override { return false; }
+    double GetDefaultDeviceScaleFactor() const override { return 1.0; }
 
     DISALLOW_COPY_AND_ASSIGN(FakeWMHelper);
   };

diff --git a/chrome/browser/chromeos/arc/arc_util.cc b/chrome/browser/chromeos/arc/arc_util.cc
index 42183b9a..2f8a452 100644
--- a/chrome/browser/chromeos/arc/arc_util.cc
+++ b/chrome/browser/chromeos/arc/arc_util.cc

@@ -9,6 +9,7 @@
 #include <set>
 
 #include "base/callback.h"
+#include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
@@ -22,6 +23,7 @@
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
+#include "chromeos/chromeos_switches.h"
 #include "components/arc/arc_util.h"
 #include "components/prefs/pref_service.h"
 #include "components/user_manager/known_user.h"
@@ -153,7 +155,7 @@
   }
 
   if (!IsArcCompatibleFileSystemUsedForProfile(profile) &&
-      !IsArcMigrationAllowedForProfile(profile)) {
+      !IsArcMigrationAllowedByPolicyForProfile(profile)) {
     VLOG_IF(1, IsReportingFirstTimeForProfile(profile))
         << "Incompatible encryption and migration forbidden.";
     return false;
@@ -184,13 +186,38 @@
   return true;
 }
 
-bool IsArcMigrationAllowedForProfile(const Profile* profile) {
+bool IsArcMigrationAllowedByPolicyForProfile(const Profile* profile) {
   if (!profile || !profile->GetPrefs()->IsManagedPreference(
                       prefs::kEcryptfsMigrationStrategy)) {
     return true;
   }
 
-  return profile->GetPrefs()->GetInteger(prefs::kEcryptfsMigrationStrategy) !=
+  int migration_strategy =
+      profile->GetPrefs()->GetInteger(prefs::kEcryptfsMigrationStrategy);
+  // |kAskForEcryptfsArcUsers| value is received only if the device is in EDU
+  // and admin left the migration policy unset. Note that when enabling ARC on
+  // the admin console, it is mandatory for the administrator to also choose a
+  // migration policy.
+  // In this default case, only a group of devices that had ARC M enabled are
+  // allowed to migrate, provided that ARC is enabled by policy.
+  // TODO(pmarko): Remove the special kAskForEcryptfsArcUsers handling when we
+  // assess that it's not necessary anymore: crbug.com/761348.
+  if (migration_strategy ==
+      static_cast<int>(
+          arc::policy_util::EcryptfsMigrationAction::kAskForEcryptfsArcUsers)) {
+    // Note that ARC enablement is controlled by policy for managed users (as
+    // it's marked 'default_for_enterprise_users': False in
+    // policy_templates.json).
+    DCHECK(profile->GetPrefs()->IsManagedPreference(prefs::kArcEnabled));
+    // We can't reuse IsArcPlayStoreEnabledForProfile here because this would
+    // lead to a circular dependency: It ends up calling this function for some
+    // cases.
+    return profile->GetPrefs()->GetBoolean(prefs::kArcEnabled) &&
+           base::CommandLine::ForCurrentProcess()->HasSwitch(
+               chromeos::switches::kArcTransitionMigrationRequired);
+  }
+
+  return migration_strategy !=
          static_cast<int>(
              arc::policy_util::EcryptfsMigrationAction::kDisallowMigration);
 }

diff --git a/chrome/browser/chromeos/arc/arc_util.h b/chrome/browser/chromeos/arc/arc_util.h
index 39c4f9b..3d12564 100644
--- a/chrome/browser/chromeos/arc/arc_util.h
+++ b/chrome/browser/chromeos/arc/arc_util.h

@@ -50,7 +50,7 @@
 // EcryptfsMigrationStrategy for the user doesn't disable the migration.
 // Specifically if the policy states to ask the user, it is also considered that
 // migration is allowed, so return true.
-bool IsArcMigrationAllowedForProfile(const Profile* profile);
+bool IsArcMigrationAllowedByPolicyForProfile(const Profile* profile);
 
 // Returns true if the profile is temporarily blocked to run ARC in the current
 // session, because the filesystem storing the profile is incompatible with the

diff --git a/chrome/browser/chromeos/arc/arc_util_unittest.cc b/chrome/browser/chromeos/arc/arc_util_unittest.cc
index 8a9ecd1..7c715667 100644
--- a/chrome/browser/chromeos/arc/arc_util_unittest.cc
+++ b/chrome/browser/chromeos/arc/arc_util_unittest.cc

@@ -24,6 +24,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/testing_profile.h"
+#include "chromeos/chromeos_switches.h"
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/prefs/pref_service.h"
 #include "components/prefs/testing_pref_service.h"
@@ -561,7 +562,7 @@
                     AccountId::AdFromUserEmailObjGuid(
                         profile()->GetProfileUserName(), kTestGaiaId));
   profile()->GetPrefs()->SetInteger(prefs::kEcryptfsMigrationStrategy, 0);
-  EXPECT_TRUE(IsArcMigrationAllowedForProfile(profile()));
+  EXPECT_TRUE(IsArcMigrationAllowedByPolicyForProfile(profile()));
 }
 
 TEST_F(ArcMigrationTest, IsMigrationAllowedForbiddenByPolicy) {
@@ -570,7 +571,7 @@
                         profile()->GetProfileUserName(), kTestGaiaId));
   profile()->GetTestingPrefService()->SetManagedPref(
       prefs::kEcryptfsMigrationStrategy, base::MakeUnique<base::Value>(0));
-  EXPECT_FALSE(IsArcMigrationAllowedForProfile(profile()));
+  EXPECT_FALSE(IsArcMigrationAllowedByPolicyForProfile(profile()));
 }
 
 TEST_F(ArcMigrationTest, IsMigrationAllowedMigrate) {
@@ -579,7 +580,7 @@
                         profile()->GetProfileUserName(), kTestGaiaId));
   profile()->GetTestingPrefService()->SetManagedPref(
       prefs::kEcryptfsMigrationStrategy, base::MakeUnique<base::Value>(1));
-  EXPECT_TRUE(IsArcMigrationAllowedForProfile(profile()));
+  EXPECT_TRUE(IsArcMigrationAllowedByPolicyForProfile(profile()));
 }
 
 TEST_F(ArcMigrationTest, IsMigrationAllowedWipe) {
@@ -588,7 +589,7 @@
                         profile()->GetProfileUserName(), kTestGaiaId));
   profile()->GetTestingPrefService()->SetManagedPref(
       prefs::kEcryptfsMigrationStrategy, base::MakeUnique<base::Value>(2));
-  EXPECT_TRUE(IsArcMigrationAllowedForProfile(profile()));
+  EXPECT_TRUE(IsArcMigrationAllowedByPolicyForProfile(profile()));
 }
 
 TEST_F(ArcMigrationTest, IsMigrationAllowedAskUser) {
@@ -597,8 +598,70 @@
                         profile()->GetProfileUserName(), kTestGaiaId));
   profile()->GetTestingPrefService()->SetManagedPref(
       prefs::kEcryptfsMigrationStrategy, base::MakeUnique<base::Value>(3));
-  EXPECT_TRUE(IsArcMigrationAllowedForProfile(profile()));
+  EXPECT_TRUE(IsArcMigrationAllowedByPolicyForProfile(profile()));
 }
 
+TEST_F(ArcMigrationTest, IsMigrationAllowedMinimalMigration) {
+  ScopedLogIn login(GetFakeUserManager(),
+                    AccountId::AdFromUserEmailObjGuid(
+                        profile()->GetProfileUserName(), kTestGaiaId));
+  profile()->GetTestingPrefService()->SetManagedPref(
+      prefs::kEcryptfsMigrationStrategy, base::MakeUnique<base::Value>(4));
+  EXPECT_TRUE(IsArcMigrationAllowedByPolicyForProfile(profile()));
+}
+
+// Defines parameters for parametrized test
+// ArcMigrationAskForEcryptfsArcUsersTest.
+struct AskForEcryptfsArcUserTestParam {
+  bool device_supported_arc;
+  bool arc_enabled;
+  bool expect_migration_allowed;
+};
+
+class ArcMigrationAskForEcryptfsArcUsersTest
+    : public ArcMigrationTest,
+      public testing::WithParamInterface<AskForEcryptfsArcUserTestParam> {
+ protected:
+  ArcMigrationAskForEcryptfsArcUsersTest() {}
+  ~ArcMigrationAskForEcryptfsArcUsersTest() override {}
+};
+
+// Migration policy is 5 (kAskForEcryptfsArcUsers, EDU default).
+TEST_P(ArcMigrationAskForEcryptfsArcUsersTest,
+       IsMigrationAllowedAskForEcryptfsArcUsers) {
+  const AskForEcryptfsArcUserTestParam& param = GetParam();
+
+  ScopedLogIn login(GetFakeUserManager(),
+                    AccountId::AdFromUserEmailObjGuid(
+                        profile()->GetProfileUserName(), kTestGaiaId));
+  if (param.device_supported_arc) {
+    base::CommandLine::ForCurrentProcess()->AppendSwitch(
+        chromeos::switches::kArcTransitionMigrationRequired);
+  }
+  profile()->GetTestingPrefService()->SetManagedPref(
+      prefs::kEcryptfsMigrationStrategy, base::MakeUnique<base::Value>(5));
+  profile()->GetTestingPrefService()->SetManagedPref(
+      prefs::kArcEnabled, base::MakeUnique<base::Value>(param.arc_enabled));
+  EXPECT_EQ(param.expect_migration_allowed,
+            IsArcMigrationAllowedByPolicyForProfile(profile()));
+}
+
+INSTANTIATE_TEST_CASE_P(
+    ArcMigrationTest,
+    ArcMigrationAskForEcryptfsArcUsersTest,
+    ::testing::Values(
+        AskForEcryptfsArcUserTestParam{true /* device_supported_arc */,
+                                       true /* arc_enabled */,
+                                       true /* expect_migration_allowed */},
+        AskForEcryptfsArcUserTestParam{true /* device_supported_arc */,
+                                       false /* arc_enabled */,
+                                       false /* expect_migration_allowed */},
+        AskForEcryptfsArcUserTestParam{false /* device_supported_arc */,
+                                       true /* arc_enabled */,
+                                       false /* expect_migration_allowed */},
+        AskForEcryptfsArcUserTestParam{false /* device_supported_arc */,
+                                       false /* arc_enabled */,
+                                       false /* expect_migration_allowed */}));
+
 }  // namespace util
 }  // namespace arc

diff --git a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.cc b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.cc
index e4ea8683..073aeee 100644
--- a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.cc
+++ b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.cc

@@ -17,6 +17,7 @@
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_framework_service.h"
 #include "chrome/browser/chromeos/first_run/first_run.h"
+#include "chrome/browser/ui/app_list/arc/arc_app_list_prefs_factory.h"
 #include "chrome/browser/ui/app_list/arc/arc_pai_starter.h"
 #include "chrome/browser/ui/ash/launcher/chrome_launcher_controller.h"
 #include "chrome/browser/ui/browser.h"
@@ -112,6 +113,7 @@
   friend base::DefaultSingletonTraits<ArcVoiceInteractionArcHomeServiceFactory>;
 
   ArcVoiceInteractionArcHomeServiceFactory() {
+    DependsOn(ArcAppListPrefsFactory::GetInstance());
     DependsOn(ArcVoiceInteractionFrameworkService::GetFactory());
   }
   ~ArcVoiceInteractionArcHomeServiceFactory() override = default;
@@ -151,9 +153,12 @@
   arc_bridge_service_->voice_interaction_arc_home()->AddObserver(this);
 }
 
-ArcVoiceInteractionArcHomeService::~ArcVoiceInteractionArcHomeService() {
-  arc_bridge_service_->voice_interaction_arc_home()->RemoveObserver(this);
+ArcVoiceInteractionArcHomeService::~ArcVoiceInteractionArcHomeService() =
+    default;
+
+void ArcVoiceInteractionArcHomeService::Shutdown() {
   ResetTimeouts();
+  arc_bridge_service_->voice_interaction_arc_home()->RemoveObserver(this);
 }
 
 void ArcVoiceInteractionArcHomeService::LockPai() {

diff --git a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.h b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.h
index acd8ecf2..4855110 100644
--- a/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.h
+++ b/chrome/browser/chromeos/arc/voice_interaction/arc_voice_interaction_arc_home_service.h

@@ -5,6 +5,8 @@
 #ifndef CHROME_BROWSER_CHROMEOS_ARC_VOICE_INTERACTION_ARC_VOICE_INTERACTION_ARC_HOME_SERVICE_H_
 #define CHROME_BROWSER_CHROMEOS_ARC_VOICE_INTERACTION_ARC_VOICE_INTERACTION_ARC_HOME_SERVICE_H_
 
+#include <string>
+
 #include "base/macros.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/ui/app_list/arc/arc_app_list_prefs.h"
@@ -52,6 +54,9 @@
   // Notifies that assistant flow has been canceled.
   void OnAssistantCanceled();
 
+  // KeyedService overrides:
+  void Shutdown() override;
+
   // InstanceHolder<mojom::VoiceInteractionArcHomeInstance> overrides;
   void OnInstanceReady() override;
   void OnInstanceClosed() override;

diff --git a/chrome/browser/chromeos/arc/wallpaper/arc_wallpaper_service.cc b/chrome/browser/chromeos/arc/wallpaper/arc_wallpaper_service.cc
index a42a25c..90a0abb 100644
--- a/chrome/browser/chromeos/arc/wallpaper/arc_wallpaper_service.cc
+++ b/chrome/browser/chromeos/arc/wallpaper/arc_wallpaper_service.cc

@@ -6,7 +6,6 @@
 
 #include <stdlib.h>
 
-#include <deque>
 #include <utility>
 
 #include "ash/shell.h"

diff --git a/chrome/browser/chromeos/extensions/default_app_order.cc b/chrome/browser/chromeos/extensions/default_app_order.cc
index fbd4211..a5ff7bb 100644
--- a/chrome/browser/chromeos/extensions/default_app_order.cc
+++ b/chrome/browser/chromeos/extensions/default_app_order.cc

@@ -54,11 +54,11 @@
     "hcglmfcclpfgljeaiahehebeoaiicbko",  // Google Photos
     "hhaomjibdihmijegdhdafkllkbggdgoj",  // Files
     extension_misc::kGooglePlayMusicAppId,
-    "mmimngoggfoobjdlefbcabngfnmieonb",  // Play Books
-    "gdijeikdkaembjbdobgfkoidjkpbmlkd",  // Play Movies & TV
-    "joodangkbfjnajiiifokapkpmhfnpleo",  // Calculator
-    "hfhhnacclhffhdffklopdkcgdhifgngh",  // Camera
-    "gbchcmhmhahfdphkhkmpfmihenigjmpp",  // Chrome Remote Desktop
+    extension_misc::kGooglePlayBooksAppId,   // Play Books
+    extension_misc::kGooglePlayMoviesAppId,  // Play Movies & TV
+    "joodangkbfjnajiiifokapkpmhfnpleo",      // Calculator
+    "hfhhnacclhffhdffklopdkcgdhifgngh",      // Camera
+    "gbchcmhmhahfdphkhkmpfmihenigjmpp",      // Chrome Remote Desktop
 };
 
 // Reads external ordinal json file and returned the parsed value. Returns NULL

diff --git a/chrome/browser/chromeos/extensions/gfx_utils.cc b/chrome/browser/chromeos/extensions/gfx_utils.cc
index 08a76b3..15a9d93 100644
--- a/chrome/browser/chromeos/extensions/gfx_utils.cc
+++ b/chrome/browser/chromeos/extensions/gfx_utils.cc

@@ -67,12 +67,12 @@
     {"com.google.android.youtube", extension_misc::kYoutubeAppId},
     {"com.google.android.youtube", "pbdihpaifchmclcmkfdgffnnpfbobefh"},
     // Google Play Books
-    {"com.google.android.apps.books", "mmimngoggfoobjdlefbcabngfnmieonb"},
+    {"com.google.android.apps.books", extension_misc::kGooglePlayBooksAppId},
     // Google+
     {"com.google.android.apps.plus", "dlppkpafhbajpcmmoheippocdidnckmm"},
     {"com.google.android.apps.plus", "fgjnkhlabjcaajddbaenilcmpcidahll"},
     // Google Play Movies & TV
-    {"com.google.android.videos", "gdijeikdkaembjbdobgfkoidjkpbmlkd"},
+    {"com.google.android.videos", extension_misc::kGooglePlayMoviesAppId},
     {"com.google.android.videos", "amfoiggnkefambnaaphodjdmdooiinna"},
     // Google Play Music
     {"com.google.android.music", extension_misc::kGooglePlayMusicAppId},

diff --git a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
index df8d6d3..8206513 100644
--- a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
+++ b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc

@@ -6,8 +6,7 @@
 
 #include <stddef.h>
 
-#include <deque>
-
+#include "base/containers/circular_deque.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_value_converter.h"
 #include "base/json/json_writer.h"
@@ -251,7 +250,7 @@
   }
 
  private:
-  std::deque<Message> messages_;
+  base::circular_deque<Message> messages_;
   content::NotificationRegistrar registrar_;
 };
 

diff --git a/chrome/browser/chromeos/file_manager/snapshot_manager.cc b/chrome/browser/chromeos/file_manager/snapshot_manager.cc
index f79bb66..5ef32c0 100644
--- a/chrome/browser/chromeos/file_manager/snapshot_manager.cc
+++ b/chrome/browser/chromeos/file_manager/snapshot_manager.cc

@@ -5,6 +5,7 @@
 #include "chrome/browser/chromeos/file_manager/snapshot_manager.h"
 
 #include "base/bind.h"
+#include "base/containers/circular_deque.h"
 #include "base/sys_info.h"
 #include "base/task_scheduler/post_task.h"
 #include "chrome/browser/chromeos/file_manager/app_id.h"
@@ -93,7 +94,8 @@
 // to be used together with base::Bind. After this function finishes, the
 // Bind callback should destruct the bound argument.
 void FreeReferenceOnIOThread(
-    const std::deque<SnapshotManager::FileReferenceWithSizeInfo>& file_refs) {
+    const base::circular_deque<SnapshotManager::FileReferenceWithSizeInfo>&
+        file_refs) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 }
 
@@ -159,7 +161,7 @@
   }
 
   // Free up to the required size.
-  std::deque<FileReferenceWithSizeInfo> to_free;
+  base::circular_deque<FileReferenceWithSizeInfo> to_free;
   while (needed_space > 0 && !file_refs_.empty()) {
     needed_space -= file_refs_.front().file_size;
     to_free.push_back(file_refs_.front());

diff --git a/chrome/browser/chromeos/file_manager/snapshot_manager.h b/chrome/browser/chromeos/file_manager/snapshot_manager.h
index 762a156d..6e465d0 100644
--- a/chrome/browser/chromeos/file_manager/snapshot_manager.h
+++ b/chrome/browser/chromeos/file_manager/snapshot_manager.h

@@ -7,9 +7,8 @@
 
 #include <stdint.h>
 
-#include <deque>
-
 #include "base/callback_forward.h"
+#include "base/containers/circular_deque.h"
 #include "base/files/file.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -76,7 +75,7 @@
       scoped_refptr<storage::ShareableFileReference> file_ref);
 
   Profile* profile_;
-  std::deque<FileReferenceWithSizeInfo> file_refs_;
+  base::circular_deque<FileReferenceWithSizeInfo> file_refs_;
 
   // Note: This should remain the last member so it'll be destroyed and
   // invalidate the weak pointers before any other members are destroyed.

diff --git a/chrome/browser/chromeos/file_system_provider/queue.h b/chrome/browser/chromeos/file_system_provider/queue.h
index abd3aec..94f66643 100644
--- a/chrome/browser/chromeos/file_system_provider/queue.h
+++ b/chrome/browser/chromeos/file_system_provider/queue.h

@@ -7,10 +7,10 @@
 
 #include <stddef.h>
 
-#include <deque>
 #include <map>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
@@ -84,7 +84,7 @@
 
   const size_t max_in_parallel_;
   size_t next_token_;
-  std::deque<Task> pending_;
+  base::circular_deque<Task> pending_;
   std::map<int, Task> executed_;
 
   base::WeakPtrFactory<Queue> weak_ptr_factory_;

diff --git a/chrome/browser/chromeos/login/easy_unlock/easy_unlock_key_manager.h b/chrome/browser/chromeos/login/easy_unlock/easy_unlock_key_manager.h
index ef8c0c72..607af6cc 100644
--- a/chrome/browser/chromeos/login/easy_unlock/easy_unlock_key_manager.h
+++ b/chrome/browser/chromeos/login/easy_unlock/easy_unlock_key_manager.h

@@ -7,12 +7,12 @@
 
 #include <stddef.h>
 
-#include <deque>
 #include <map>
 #include <memory>
 #include <string>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/chromeos/login/easy_unlock/easy_unlock_get_keys_operation.h"
@@ -102,9 +102,10 @@
                      bool fetch_success,
                      const EasyUnlockDeviceKeyDataList& fetched_data);
 
-  std::deque<std::unique_ptr<EasyUnlockRefreshKeysOperation>>
+  base::circular_deque<std::unique_ptr<EasyUnlockRefreshKeysOperation>>
       write_operation_queue_;
-  std::deque<std::unique_ptr<EasyUnlockGetKeysOperation>> read_operation_queue_;
+  base::circular_deque<std::unique_ptr<EasyUnlockGetKeysOperation>>
+      read_operation_queue_;
 
   // Stores the current operation in progress. At most one of these variables
   // can be non-null at any time.

diff --git a/chrome/browser/chromeos/login/existing_user_controller.cc b/chrome/browser/chromeos/login/existing_user_controller.cc
index c75bfec..41f04af 100644
--- a/chrome/browser/chromeos/login/existing_user_controller.cc
+++ b/chrome/browser/chromeos/login/existing_user_controller.cc

@@ -243,6 +243,15 @@
   return true;
 }
 
+// Returns true if ArcEnabled policy is present and set to true. Otherwise
+// returns false.
+bool IsArcEnabledFromPolicy(
+    const enterprise_management::CloudPolicySettings* policy) {
+  if (policy->has_arcenabled())
+    return policy->arcenabled().value();
+  return false;
+}
+
 }  // namespace
 
 // static
@@ -1046,6 +1055,11 @@
   VLOG(1) << "Migration action: " << static_cast<int>(action);
 
   switch (action) {
+    case apu::EcryptfsMigrationAction::kDisallowMigration:
+      ContinuePerformLoginWithoutMigration(login_performer_->auth_mode(),
+                                           user_context);
+      break;
+
     case apu::EcryptfsMigrationAction::kMigrate:
       user_manager::known_user::SetUserHomeMinimalMigrationAttempted(
           user_context.GetAccountId(), false);
@@ -1080,11 +1094,18 @@
       break;
 
     case apu::EcryptfsMigrationAction::kAskForEcryptfsArcUsers:
-    // TODO(igorcov): Fall-through intended. This behaves as Disallow Migration
-    // until it's implemented.
-    case apu::EcryptfsMigrationAction::kDisallowMigration:
-      ContinuePerformLoginWithoutMigration(login_performer_->auth_mode(),
-                                           user_context);
+      // If the device is transitioning from ARC M to ARC N and has ARC enabled
+      // by policy, then ask the user about the migration. Otherwise disallow
+      // migration.
+      if (IsArcEnabledFromPolicy(policy_payload.get()) &&
+          base::CommandLine::ForCurrentProcess()->HasSwitch(
+              switches::kArcTransitionMigrationRequired)) {
+        ShowEncryptionMigrationScreen(user_context,
+                                      EncryptionMigrationMode::ASK_USER);
+      } else {
+        ContinuePerformLoginWithoutMigration(login_performer_->auth_mode(),
+                                             user_context);
+      }
       break;
   }
 }

diff --git a/chrome/browser/chromeos/login/ui/login_web_dialog.cc b/chrome/browser/chromeos/login/ui/login_web_dialog.cc
index f20d107..2fd5f0f2 100644
--- a/chrome/browser/chromeos/login/ui/login_web_dialog.cc
+++ b/chrome/browser/chromeos/login/ui/login_web_dialog.cc

@@ -4,8 +4,7 @@
 
 #include "chrome/browser/chromeos/login/ui/login_web_dialog.h"
 
-#include <deque>
-
+#include "base/containers/circular_deque.h"
 #include "base/lazy_instance.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/chromeos/login/helper.h"
@@ -33,7 +32,7 @@
 const double kMinimumWidthRatio = 0.25;
 const double kMinimumHeightRatio = 0.25;
 
-base::LazyInstance<std::deque<WebContents*>>::DestructorAtExit
+base::LazyInstance<base::circular_deque<WebContents*>>::DestructorAtExit
     g_web_contents_stack = LAZY_INSTANCE_INITIALIZER;
 
 // Returns the accelerator which is mapped as hangup button on Chrome OS CFM

diff --git a/chrome/browser/chromeos/policy/device_status_collector.h b/chrome/browser/chromeos/policy/device_status_collector.h
index 233a132..cff40c8 100644
--- a/chrome/browser/chromeos/policy/device_status_collector.h
+++ b/chrome/browser/chromeos/policy/device_status_collector.h

@@ -7,7 +7,6 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <memory>
 #include <string>
 #include <vector>
@@ -15,6 +14,7 @@
 #include "base/callback_forward.h"
 #include "base/callback_list.h"
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
@@ -244,7 +244,7 @@
 
   // Samples of resource usage (contains multiple samples taken
   // periodically every kHardwareStatusSampleIntervalSeconds).
-  std::deque<ResourceUsage> resource_usage_;
+  base::circular_deque<ResourceUsage> resource_usage_;
 
   // Callback invoked to fetch information about the mounted disk volumes.
   VolumeInfoFetcher volume_info_fetcher_;

diff --git a/chrome/browser/chromeos/power/cpu_data_collector.h b/chrome/browser/chromeos/power/cpu_data_collector.h
index 7dba3fe5..3f37397 100644
--- a/chrome/browser/chromeos/power/cpu_data_collector.h
+++ b/chrome/browser/chromeos/power/cpu_data_collector.h

@@ -7,11 +7,11 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <map>
 #include <string>
 #include <vector>
 
+#include "base/containers/circular_deque.h"
 #include "base/files/file_util.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
@@ -47,7 +47,7 @@
     std::vector<base::TimeDelta> time_in_state;
   };
 
-  typedef std::deque<StateOccupancySample> StateOccupancySampleDeque;
+  using StateOccupancySampleDeque = base::circular_deque<StateOccupancySample>;
 
   const std::vector<std::string>& cpu_idle_state_names() const {
     return cpu_idle_state_names_;

diff --git a/chrome/browser/chromeos/power/power_data_collector.h b/chrome/browser/chromeos/power/power_data_collector.h
index 91eeca6..8489ee9 100644
--- a/chrome/browser/chromeos/power/power_data_collector.h
+++ b/chrome/browser/chromeos/power/power_data_collector.h

@@ -5,9 +5,8 @@
 #ifndef CHROME_BROWSER_CHROMEOS_POWER_POWER_DATA_COLLECTOR_H_
 #define CHROME_BROWSER_CHROMEOS_POWER_POWER_DATA_COLLECTOR_H_
 
-#include <deque>
-
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/time/time.h"
 #include "chrome/browser/chromeos/power/cpu_data_collector.h"
@@ -56,11 +55,11 @@
     base::TimeDelta sleep_duration;
   };
 
-  const std::deque<PowerSupplySample>& power_supply_data() const {
+  const base::circular_deque<PowerSupplySample>& power_supply_data() const {
     return power_supply_data_;
   }
 
-  const std::deque<SystemResumedSample>& system_resumed_data() const {
+  const base::circular_deque<SystemResumedSample>& system_resumed_data() const {
     return system_resumed_data_;
   }
 
@@ -94,8 +93,8 @@
 
   ~PowerDataCollector() override;
 
-  std::deque<PowerSupplySample> power_supply_data_;
-  std::deque<SystemResumedSample> system_resumed_data_;
+  base::circular_deque<PowerSupplySample> power_supply_data_;
+  base::circular_deque<SystemResumedSample> system_resumed_data_;
   CpuDataCollector cpu_data_collector_;
 
   DISALLOW_COPY_AND_ASSIGN(PowerDataCollector);
@@ -105,7 +104,8 @@
 // It dumps samples |PowerDataCollector::kSampleTimeLimitSec| or more older than
 // |sample|.
 template <typename SampleType>
-void AddSample(std::deque<SampleType>* sample_queue, const SampleType& sample) {
+void AddSample(base::circular_deque<SampleType>* sample_queue,
+               const SampleType& sample) {
   while (!sample_queue->empty()) {
     const SampleType& first = sample_queue->front();
     if (sample.time - first.time >

diff --git a/chrome/browser/chromeos/power/power_data_collector_unittest.cc b/chrome/browser/chromeos/power/power_data_collector_unittest.cc
index 18cd169..197b509 100644
--- a/chrome/browser/chromeos/power/power_data_collector_unittest.cc
+++ b/chrome/browser/chromeos/power/power_data_collector_unittest.cc

@@ -39,7 +39,7 @@
   prop1.set_external_power(power_manager::PowerSupplyProperties::DISCONNECTED);
   prop1.set_battery_percent(20.00);
   power_data_collector_->PowerChanged(prop1);
-  const std::deque<PowerDataCollector::PowerSupplySample>& data1 =
+  const base::circular_deque<PowerDataCollector::PowerSupplySample>& data1 =
       power_data_collector_->power_supply_data();
   ASSERT_EQ(static_cast<size_t>(1), data1.size());
   EXPECT_DOUBLE_EQ(prop1.battery_percent(), data1[0].battery_percent);
@@ -48,7 +48,7 @@
   prop2.set_external_power(power_manager::PowerSupplyProperties::AC);
   prop2.set_battery_percent(100.00);
   power_data_collector_->PowerChanged(prop2);
-  const std::deque<PowerDataCollector::PowerSupplySample>& data2 =
+  const base::circular_deque<PowerDataCollector::PowerSupplySample>& data2 =
       power_data_collector_->power_supply_data();
   ASSERT_EQ(static_cast<size_t>(2), data2.size());
   EXPECT_DOUBLE_EQ(prop2.battery_percent(), data2[1].battery_percent);
@@ -57,20 +57,20 @@
 
 TEST_F(PowerDataCollectorTest, SuspendDone) {
   power_data_collector_->SuspendDone(base::TimeDelta::FromSeconds(10));
-  const std::deque<PowerDataCollector::SystemResumedSample>& data1 =
+  const base::circular_deque<PowerDataCollector::SystemResumedSample>& data1 =
       power_data_collector_->system_resumed_data();
   ASSERT_EQ(static_cast<size_t>(1), data1.size());
   ASSERT_EQ(static_cast<int64_t>(10), data1[0].sleep_duration.InSeconds());
 
   power_data_collector_->SuspendDone(base::TimeDelta::FromSeconds(20));
-  const std::deque<PowerDataCollector::SystemResumedSample>& data2 =
+  const base::circular_deque<PowerDataCollector::SystemResumedSample>& data2 =
       power_data_collector_->system_resumed_data();
   ASSERT_EQ(static_cast<size_t>(2), data2.size());
   ASSERT_EQ(static_cast<int64_t>(20), data2[1].sleep_duration.InSeconds());
 }
 
 TEST_F(PowerDataCollectorTest, AddSample) {
-  std::deque<PowerDataCollector::PowerSupplySample> sample_deque;
+  base::circular_deque<PowerDataCollector::PowerSupplySample> sample_deque;
   PowerDataCollector::PowerSupplySample sample1, sample2;
   sample1.time = base::Time::FromInternalValue(1000);
   sample2.time = sample1.time +

diff --git a/chrome/browser/chromeos/settings/device_settings_service.h b/chrome/browser/chromeos/settings/device_settings_service.h
index 4cf876eb..61581ed 100644
--- a/chrome/browser/chromeos/settings/device_settings_service.h
+++ b/chrome/browser/chromeos/settings/device_settings_service.h

@@ -5,13 +5,13 @@
 #ifndef CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_SETTINGS_SERVICE_H_
 #define CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_SETTINGS_SERVICE_H_
 
-#include <deque>
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "base/callback.h"
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/linked_ptr.h"
 #include "base/memory/ref_counted.h"
@@ -251,7 +251,7 @@
 
   // The queue of pending operations. The first operation on the queue is
   // currently active; it gets removed and destroyed once it completes.
-  std::deque<linked_ptr<SessionManagerOperation>> pending_operations_;
+  base::circular_deque<linked_ptr<SessionManagerOperation>> pending_operations_;
 
   base::ObserverList<Observer> observers_;
 

diff --git a/chrome/browser/extensions/BUILD.gn b/chrome/browser/extensions/BUILD.gn
index ef99a4c..5e6fcdb 100644
--- a/chrome/browser/extensions/BUILD.gn
+++ b/chrome/browser/extensions/BUILD.gn

@@ -872,6 +872,7 @@
     "//extensions/common/api",
     "//extensions/features",
     "//extensions/strings",
+    "//google_apis",
     "//media:media_features",
     "//net",
     "//ppapi/features",
@@ -965,6 +966,7 @@
       configs += [ "//build/config/linux/dbus" ]
     }
     deps += [
+      "//components/arc",
       "//components/chrome_apps",
       "//components/constrained_window",
       "//components/drive",

diff --git a/chrome/browser/extensions/DEPS b/chrome/browser/extensions/DEPS
index ab2d5023..4dd7e5e 100644
--- a/chrome/browser/extensions/DEPS
+++ b/chrome/browser/extensions/DEPS

@@ -8,6 +8,7 @@
   "+components/user_manager",
   "+extensions/strings/grit/extensions_strings.h",
   "+ui/base",
+  "+components/arc",
   "+components/vector_icons",
 
   # For access to testing command line switches.

diff --git a/chrome/browser/extensions/api/braille_display_private/braille_display_private_apitest.cc b/chrome/browser/extensions/api/braille_display_private/braille_display_private_apitest.cc
index fc092a6..3f507efa 100644
--- a/chrome/browser/extensions/api/braille_display_private/braille_display_private_apitest.cc
+++ b/chrome/browser/extensions/api/braille_display_private/braille_display_private_apitest.cc

@@ -4,9 +4,8 @@
 
 #include <stddef.h>
 
-#include <deque>
-
 #include "base/bind.h"
+#include "base/containers/circular_deque.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/chromeos/accessibility/accessibility_manager.h"
@@ -57,7 +56,7 @@
   std::vector<std::string> written_content;
   // List of brlapi key codes.  A negative number makes the connection mock
   // return an error from ReadKey.
-  std::deque<brlapi_keyCode_t> pending_keys;
+  base::circular_deque<brlapi_keyCode_t> pending_keys;
   // Causes a new display to appear to appear on disconnect, that is the
   // display size doubles and the controller gets notified of a brltty
   // restart.

diff --git a/chrome/browser/extensions/api/chrome_extensions_api_client.cc b/chrome/browser/extensions/api/chrome_extensions_api_client.cc
index 48d7da4..58646f7 100644
--- a/chrome/browser/extensions/api/chrome_extensions_api_client.cc
+++ b/chrome/browser/extensions/api/chrome_extensions_api_client.cc

@@ -4,9 +4,12 @@
 
 #include "chrome/browser/extensions/api/chrome_extensions_api_client.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/files/file_path.h"
 #include "base/memory/ptr_util.h"
+#include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/data_use_measurement/data_use_web_contents_observer.h"
 #include "chrome/browser/extensions/api/chrome_device_permissions_prompt.h"
@@ -31,12 +34,15 @@
 #include "chrome/browser/guest_view/web_view/chrome_web_view_permission_helper_delegate.h"
 #include "chrome/browser/ui/pdf/chrome_pdf_web_contents_helper_client.h"
 #include "components/pdf/browser/pdf_web_contents_helper.h"
+#include "components/signin/core/browser/signin_header_helper.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "extensions/browser/api/virtual_keyboard_private/virtual_keyboard_delegate.h"
 #include "extensions/browser/guest_view/web_view/web_view_guest.h"
 #include "extensions/browser/guest_view/web_view/web_view_permission_helper.h"
+#include "google_apis/gaia/gaia_urls.h"
 #include "printing/features/features.h"
+#include "url/gurl.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/extensions/api/file_handlers/non_native_file_system_delegate_chromeos.h"
@@ -85,6 +91,17 @@
       web_contents);
 }
 
+bool ChromeExtensionsAPIClient::ShouldHideResponseHeader(
+    const GURL& url,
+    const std::string& header_name) const {
+  // Gaia may send a OAUth2 authorization code in the Dice response header,
+  // which could allow an extension to generate a refresh token for the account.
+  return (
+      (url.host_piece() == GaiaUrls::GetInstance()->gaia_url().host_piece()) &&
+      (base::CompareCaseInsensitiveASCII(header_name,
+                                         signin::kDiceResponseHeader) == 0));
+}
+
 AppViewGuestDelegate* ChromeExtensionsAPIClient::CreateAppViewGuestDelegate()
     const {
   return new ChromeAppViewGuestDelegate();

diff --git a/chrome/browser/extensions/api/chrome_extensions_api_client.h b/chrome/browser/extensions/api/chrome_extensions_api_client.h
index b1c93a7..eb300332 100644
--- a/chrome/browser/extensions/api/chrome_extensions_api_client.h
+++ b/chrome/browser/extensions/api/chrome_extensions_api_client.h

@@ -30,6 +30,8 @@
       override;
   void AttachWebContentsHelpers(content::WebContents* web_contents) const
       override;
+  bool ShouldHideResponseHeader(const GURL& url,
+                                const std::string& header_name) const override;
   AppViewGuestDelegate* CreateAppViewGuestDelegate() const override;
   ExtensionOptionsGuestDelegate* CreateExtensionOptionsGuestDelegate(
       ExtensionOptionsGuest* guest) const override;

diff --git a/chrome/browser/extensions/api/chrome_extensions_api_client_unittest.cc b/chrome/browser/extensions/api/chrome_extensions_api_client_unittest.cc
new file mode 100644
index 0000000..8e2738c0
--- /dev/null
+++ b/chrome/browser/extensions/api/chrome_extensions_api_client_unittest.cc

@@ -0,0 +1,25 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/extensions/api/chrome_extensions_api_client.h"
+
+#include "google_apis/gaia/gaia_urls.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace extensions {
+
+TEST(TestChromeExtensionsAPIClient, ShouldHideResponseHeader) {
+  ChromeExtensionsAPIClient client;
+  EXPECT_TRUE(client.ShouldHideResponseHeader(
+      GaiaUrls::GetInstance()->gaia_url(), "X-Chrome-ID-Consistency-Response"));
+  EXPECT_TRUE(client.ShouldHideResponseHeader(
+      GaiaUrls::GetInstance()->gaia_url(), "x-cHroMe-iD-CoNsiStenCY-RESPoNSE"));
+  EXPECT_FALSE(client.ShouldHideResponseHeader(
+      GURL("http://www.example.com"), "X-Chrome-ID-Consistency-Response"));
+  EXPECT_FALSE(client.ShouldHideResponseHeader(
+      GaiaUrls::GetInstance()->gaia_url(), "Google-Accounts-SignOut"));
+}
+
+}  // namespace extensions

diff --git a/chrome/browser/extensions/api/downloads/downloads_api_browsertest.cc b/chrome/browser/extensions/api/downloads/downloads_api_browsertest.cc
index 282febf..b88a7e9 100644
--- a/chrome/browser/extensions/api/downloads/downloads_api_browsertest.cc
+++ b/chrome/browser/extensions/api/downloads/downloads_api_browsertest.cc

@@ -10,6 +10,7 @@
 
 #include <algorithm>
 
+#include "base/containers/circular_deque.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/guid.h"
@@ -237,7 +238,7 @@
   base::Time last_wait_;
   std::unique_ptr<Event> waiting_for_;
   content::NotificationRegistrar registrar_;
-  std::deque<std::unique_ptr<Event>> events_;
+  base::circular_deque<std::unique_ptr<Event>> events_;
 
   DISALLOW_COPY_AND_ASSIGN(DownloadsEventsListener);
 };

diff --git a/chrome/browser/extensions/api/notifications/notifications_apitest.cc b/chrome/browser/extensions/api/notifications/notifications_apitest.cc
index fef2b34c..990fc637 100644
--- a/chrome/browser/extensions/api/notifications/notifications_apitest.cc
+++ b/chrome/browser/extensions/api/notifications/notifications_apitest.cc

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/containers/circular_deque.h"
 #include "base/message_loop/message_loop.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
@@ -98,7 +99,7 @@
   content::NotificationRegistrar registrar_;
 
   // A sequential list of user gesture notifications from the test extension(s).
-  std::deque<bool> results_;
+  base::circular_deque<bool> results_;
 
   // True if we're in a nested run loop waiting for results from
   // the extension.

diff --git a/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate_unittest.cc b/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate_unittest.cc
index 30334b55..355d8f5 100644
--- a/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate_unittest.cc
+++ b/chrome/browser/extensions/api/runtime/chrome_runtime_api_delegate_unittest.cc

@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <deque>
 #include <memory>
 #include <set>
 #include <utility>

diff --git a/chrome/browser/extensions/api/socket/tls_socket_unittest.cc b/chrome/browser/extensions/api/socket/tls_socket_unittest.cc
index 09633f1..e882c99a 100644
--- a/chrome/browser/extensions/api/socket/tls_socket_unittest.cc
+++ b/chrome/browser/extensions/api/socket/tls_socket_unittest.cc

@@ -5,10 +5,10 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <deque>
 #include <memory>
 #include <utility>
 
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/strings/string_piece.h"
 #include "extensions/browser/api/socket/tls_socket.h"
@@ -242,7 +242,7 @@
 
 typedef std::pair<net::CompletionCallback, int> PendingCallback;
 
-class CallbackList : public std::deque<PendingCallback> {
+class CallbackList : public base::circular_deque<PendingCallback> {
  public:
   void append(const net::CompletionCallback& cb, int arg) {
     push_back(std::make_pair(cb, arg));

diff --git a/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc b/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc
index 944e035..6e29c8b0 100644
--- a/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc

@@ -50,12 +50,15 @@
 #include "extensions/common/api/web_request.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/features/feature.h"
+#include "google_apis/gaia/gaia_urls.h"
 #include "net/base/auth.h"
 #include "net/base/elements_upload_data_stream.h"
 #include "net/base/request_priority.h"
 #include "net/base/upload_bytes_element_reader.h"
 #include "net/base/upload_file_element_reader.h"
 #include "net/dns/mock_host_resolver.h"
+#include "net/http/http_response_headers.h"
+#include "net/http/http_util.h"
 #include "net/log/net_log_with_source.h"
 #include "net/log/test_net_log.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
@@ -1485,6 +1488,7 @@
       "Key2: Value2, Bar\r\n"
       "Key3: Value3\r\n"
       "Key5: Value5, end5\r\n"
+      "X-Chrome-ID-Consistency-Response: Value6\r\n"
       "\r\n";
   scoped_refptr<net::HttpResponseHeaders> base_headers(
       new net::HttpResponseHeaders(
@@ -1497,11 +1501,39 @@
   // Key3 is deleted
   new_headers.push_back(ResponseHeader("Key4", "Value4"));  // Added
   new_headers.push_back(ResponseHeader("Key5", "Value5, end5"));  // Unchanged
-  GURL effective_new_url;
+  new_headers.push_back(ResponseHeader("X-Chrome-ID-Consistency-Response",
+                                       "Value1"));  // Modified
+  GURL url;
 
-  std::unique_ptr<EventResponseDelta> delta(CalculateOnHeadersReceivedDelta(
-      "extid", base::Time::Now(), cancel, effective_new_url, base_headers.get(),
-      &new_headers));
+  // The X-Chrome-ID-Consistency-Response is a protected header, but only for
+  // Gaia URLs. It should be modifiable when sent from anywhere else.
+  // Non-Gaia URL:
+  std::unique_ptr<EventResponseDelta> delta(
+      CalculateOnHeadersReceivedDelta("extid", base::Time::Now(), cancel, url,
+                                      url, base_headers.get(), &new_headers));
+  ASSERT_TRUE(delta.get());
+  EXPECT_TRUE(delta->cancel);
+  EXPECT_EQ(3u, delta->added_response_headers.size());
+  EXPECT_TRUE(base::ContainsValue(delta->added_response_headers,
+                                  ResponseHeader("Key2", "Value1")));
+  EXPECT_TRUE(base::ContainsValue(delta->added_response_headers,
+                                  ResponseHeader("Key4", "Value4")));
+  EXPECT_TRUE(base::ContainsValue(
+      delta->added_response_headers,
+      ResponseHeader("X-Chrome-ID-Consistency-Response", "Value1")));
+  EXPECT_EQ(3u, delta->deleted_response_headers.size());
+  EXPECT_TRUE(base::ContainsValue(delta->deleted_response_headers,
+                                  ResponseHeader("Key2", "Value2, Bar")));
+  EXPECT_TRUE(base::ContainsValue(delta->deleted_response_headers,
+                                  ResponseHeader("Key3", "Value3")));
+  EXPECT_TRUE(base::ContainsValue(
+      delta->deleted_response_headers,
+      ResponseHeader("X-Chrome-ID-Consistency-Response", "Value6")));
+
+  // Gaia URL:
+  delta.reset(CalculateOnHeadersReceivedDelta(
+      "extid", base::Time::Now(), cancel, GaiaUrls::GetInstance()->gaia_url(),
+      url, base_headers.get(), &new_headers));
   ASSERT_TRUE(delta.get());
   EXPECT_TRUE(delta->cancel);
   EXPECT_EQ(2u, delta->added_response_headers.size());

diff --git a/chrome/browser/extensions/api/web_request/web_request_apitest.cc b/chrome/browser/extensions/api/web_request/web_request_apitest.cc
index f5fcff50..873abeb 100644
--- a/chrome/browser/extensions/api/web_request/web_request_apitest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_apitest.cc

@@ -30,6 +30,7 @@
 #include "chromeos/login/scoped_test_public_session_login_state.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
@@ -45,7 +46,9 @@
 #include "extensions/common/features/feature.h"
 #include "extensions/test/extension_test_message_listener.h"
 #include "extensions/test/result_catcher.h"
+#include "google_apis/gaia/gaia_switches.h"
 #include "net/dns/mock_host_resolver.h"
+#include "net/http/http_util.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/test_data_directory.h"
@@ -104,6 +107,10 @@
     "};\n"
     "xhr.send();\n";
 
+// Header values set by the server and by the extension.
+const char kHeaderValueFromExtension[] = "ValueFromExtension";
+const char kHeaderValueFromServer[] = "ValueFromServer";
+
 // Performs an XHR in the given |frame|, replying when complete.
 void PerformXhrInFrame(content::RenderFrameHost* frame,
                       const std::string& host,
@@ -204,6 +211,11 @@
     host_resolver()->AddRule("*", "127.0.0.1");
   }
 
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ExtensionApiTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitchASCII(switches::kGaiaUrl, "http://gaia.com");
+  }
+
   void RunPermissionTest(
       const char* extension_directory,
       bool load_extension_with_incognito_permission,
@@ -846,6 +858,112 @@
             GetWebRequestCountFromBackgroundPage(extension, profile()));
 }
 
+// Checks that the Dice response header is protected for Gaia URLs, but not
+// other URLs.
+IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest,
+                       WebRequestDiceHeaderProtection) {
+  // Load an extension that registers a listener for webRequest events, and
+  // wait until it is initialized.
+  ExtensionTestMessageListener listener("ready", false);
+  const Extension* extension =
+      LoadExtension(test_data_dir_.AppendASCII("webrequest_dice_header"));
+  ASSERT_TRUE(extension) << message_;
+  EXPECT_TRUE(listener.WaitUntilSatisfied());
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // Setup a web contents observer to inspect the response headers after the
+  // extension was run.
+  class TestWebContentsObserver : public content::WebContentsObserver {
+   public:
+    explicit TestWebContentsObserver(content::WebContents* contents)
+        : WebContentsObserver(contents) {}
+
+    void DidFinishNavigation(
+        content::NavigationHandle* navigation_handle) override {
+      // Check that the extension cannot add a Dice header.
+      const net::HttpResponseHeaders* headers =
+          navigation_handle->GetResponseHeaders();
+      EXPECT_TRUE(headers->GetNormalizedHeader(
+          "X-Chrome-ID-Consistency-Response", &dice_header_value_));
+      EXPECT_TRUE(
+          headers->GetNormalizedHeader("X-New-Header", &new_header_value_));
+      EXPECT_TRUE(
+          headers->GetNormalizedHeader("X-Control", &control_header_value_));
+      did_finish_navigation_called_ = true;
+    }
+
+    bool did_finish_navigation_called() const {
+      return did_finish_navigation_called_;
+    }
+
+    const std::string& dice_header_value() const { return dice_header_value_; }
+
+    const std::string& new_header_value() const { return new_header_value_; }
+
+    const std::string& control_header_value() const {
+      return control_header_value_;
+    }
+
+    void Clear() {
+      did_finish_navigation_called_ = false;
+      dice_header_value_.clear();
+      new_header_value_.clear();
+      control_header_value_.clear();
+    }
+
+   private:
+    bool did_finish_navigation_called_ = false;
+    std::string dice_header_value_;
+    std::string new_header_value_;
+    std::string control_header_value_;
+  };
+
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  TestWebContentsObserver test_webcontents_observer(web_contents);
+
+  // Navigate to the Gaia URL intercepted by the extension.
+  GURL url =
+      embedded_test_server()->GetURL("gaia.com", "/extensions/dice.html");
+  ui_test_utils::NavigateToURL(browser(), url);
+
+  // Check that the Dice header was not changed by the extension.
+  EXPECT_TRUE(test_webcontents_observer.did_finish_navigation_called());
+  EXPECT_EQ(kHeaderValueFromServer,
+            test_webcontents_observer.dice_header_value());
+  EXPECT_EQ(kHeaderValueFromExtension,
+            test_webcontents_observer.new_header_value());
+  EXPECT_EQ(kHeaderValueFromExtension,
+            test_webcontents_observer.control_header_value());
+
+  // Check that the Dice header cannot be read by the extension.
+  EXPECT_EQ(0, GetCountFromBackgroundPage(extension, profile(),
+                                          "window.diceResponseHeaderCount"));
+  EXPECT_EQ(1, GetCountFromBackgroundPage(extension, profile(),
+                                          "window.controlResponseHeaderCount"));
+
+  // Navigate to a non-Gaia URL intercepted by the extension.
+  test_webcontents_observer.Clear();
+  url = embedded_test_server()->GetURL("example.com", "/extensions/dice.html");
+  ui_test_utils::NavigateToURL(browser(), url);
+
+  // Check that the Dice header was changed by the extension.
+  EXPECT_TRUE(test_webcontents_observer.did_finish_navigation_called());
+  EXPECT_EQ(kHeaderValueFromExtension,
+            test_webcontents_observer.dice_header_value());
+  EXPECT_EQ(kHeaderValueFromExtension,
+            test_webcontents_observer.new_header_value());
+  EXPECT_EQ(kHeaderValueFromExtension,
+            test_webcontents_observer.control_header_value());
+
+  // Check that the Dice header can be read by the extension.
+  EXPECT_EQ(1, GetCountFromBackgroundPage(extension, profile(),
+                                          "window.diceResponseHeaderCount"));
+  EXPECT_EQ(2, GetCountFromBackgroundPage(extension, profile(),
+                                          "window.controlResponseHeaderCount"));
+}
+
 // Test that the webRequest events are dispatched for the WebSocket handshake
 // requests.
 IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest, WebSocketRequest) {

diff --git a/chrome/browser/extensions/api/web_request/web_request_event_details_unittest.cc b/chrome/browser/extensions/api/web_request/web_request_event_details_unittest.cc
index 4501c524..b68ccc59 100644
--- a/chrome/browser/extensions/api/web_request/web_request_event_details_unittest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_event_details_unittest.cc

@@ -4,7 +4,17 @@
 
 #include "extensions/browser/api/web_request/web_request_event_details.h"
 
+#include "base/message_loop/message_loop.h"
+#include "base/values.h"
+#include "extensions/browser/api/web_request/web_request_api_constants.h"
+#include "extensions/browser/api/web_request/web_request_api_helpers.h"
+#include "google_apis/gaia/gaia_urls.h"
+#include "net/http/http_response_headers.h"
+#include "net/http/http_util.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
+#include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
 
 namespace extensions {
 
@@ -64,4 +74,60 @@
   EXPECT_EQ(arraysize(safe_attributes) + 1, copy->dict_.size());
 }
 
+TEST(WebRequestEventDetailsTest, SetResponseHeaders) {
+  const int kFilter =
+      extension_web_request_api_helpers::ExtraInfoSpec::RESPONSE_HEADERS;
+  base::MessageLoop message_loop;
+  net::TestURLRequestContext context;
+
+  char headers_string[] =
+      "HTTP/1.0 200 OK\r\n"
+      "Key1: Value1\r\n"
+      "X-Chrome-ID-Consistency-Response: Value2\r\n"
+      "\r\n";
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(net::HttpUtil::AssembleRawHeaders(
+          headers_string, sizeof(headers_string))));
+
+  {
+    // Non-Gaia URL.
+    std::unique_ptr<net::URLRequest> request = context.CreateRequest(
+        GURL("http://www.example.com"), net::DEFAULT_PRIORITY, nullptr,
+        TRAFFIC_ANNOTATION_FOR_TESTS);
+    WebRequestEventDetails details(request.get(), kFilter);
+    details.SetResponseHeaders(request.get(), headers.get());
+    std::unique_ptr<base::DictionaryValue> dict =
+        details.GetFilteredDict(kFilter);
+    base::Value* filtered_headers = dict->FindPath({"responseHeaders"});
+    ASSERT_TRUE(filtered_headers);
+    EXPECT_EQ(2u, filtered_headers->GetList().size());
+    EXPECT_EQ("Key1",
+              filtered_headers->GetList()[0].FindPath({"name"})->GetString());
+    EXPECT_EQ("Value1",
+              filtered_headers->GetList()[0].FindPath({"value"})->GetString());
+    EXPECT_EQ("X-Chrome-ID-Consistency-Response",
+              filtered_headers->GetList()[1].FindPath({"name"})->GetString());
+    EXPECT_EQ("Value2",
+              filtered_headers->GetList()[1].FindPath({"value"})->GetString());
+  }
+
+  {
+    // Gaia URL.
+    std::unique_ptr<net::URLRequest> gaia_request = context.CreateRequest(
+        GaiaUrls::GetInstance()->gaia_url(), net::DEFAULT_PRIORITY, nullptr,
+        TRAFFIC_ANNOTATION_FOR_TESTS);
+    WebRequestEventDetails gaia_details(gaia_request.get(), kFilter);
+    gaia_details.SetResponseHeaders(gaia_request.get(), headers.get());
+    std::unique_ptr<base::DictionaryValue> dict =
+        gaia_details.GetFilteredDict(kFilter);
+    base::Value* filtered_headers = dict->FindPath({"responseHeaders"});
+    ASSERT_TRUE(filtered_headers);
+    EXPECT_EQ(1u, filtered_headers->GetList().size());
+    EXPECT_EQ("Key1",
+              filtered_headers->GetList()[0].FindPath({"name"})->GetString());
+    EXPECT_EQ("Value1",
+              filtered_headers->GetList()[0].FindPath({"value"})->GetString());
+  }
+}
+
 }  // namespace extensions

diff --git a/chrome/browser/extensions/extension_apitest.h b/chrome/browser/extensions/extension_apitest.h
index 87226d3..5cac23a 100644
--- a/chrome/browser/extensions/extension_apitest.h
+++ b/chrome/browser/extensions/extension_apitest.h

@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_APITEST_H_
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_APITEST_H_
 
-#include <deque>
 #include <string>
 
 #include "base/compiler_specific.h"

diff --git a/chrome/browser/extensions/extension_bindings_apitest.cc b/chrome/browser/extensions/extension_bindings_apitest.cc
index be3c484..1bb1f6f 100644
--- a/chrome/browser/extensions/extension_bindings_apitest.cc
+++ b/chrome/browser/extensions/extension_bindings_apitest.cc

@@ -5,6 +5,7 @@
 // Contains holistic tests of the bindings infrastructure
 
 #include "base/run_loop.h"
+#include "build/build_config.h"
 #include "chrome/browser/extensions/api/permissions/permissions_api.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/net/url_request_mock_util.h"
@@ -240,7 +241,16 @@
 // messages ("receiver") and one which we'll try first faking messages from in
 // the web page's iframe, as well as actually send a message from later
 // ("sender").
-IN_PROC_BROWSER_TEST_P(FramesExtensionBindingsApiTest, FramesBeforeNavigation) {
+
+// This test is currently flaking on Linux and Mac builders
+// https://crbug.com/761368
+#if defined(OS_LINUX) || defined(OS_MACOSX)
+#define MAYBE_FramesBeforeNavigation DISABLED_FramesBeforeNavigation
+#else
+#define MAYBE_FramesBeforeNavigation FramesBeforeNavigation
+#endif
+IN_PROC_BROWSER_TEST_P(FramesExtensionBindingsApiTest,
+                       MAYBE_FramesBeforeNavigation) {
   // Load the sender and receiver extensions, and make sure they are ready.
   ExtensionTestMessageListener sender_ready("sender_ready", true);
   const Extension* sender = LoadExtension(

diff --git a/chrome/browser/extensions/external_provider_impl.cc b/chrome/browser/extensions/external_provider_impl.cc
index 00b221f..25414e4 100644
--- a/chrome/browser/extensions/external_provider_impl.cc
+++ b/chrome/browser/extensions/external_provider_impl.cc

@@ -54,6 +54,7 @@
 #include "chrome/browser/chromeos/policy/device_local_account.h"
 #include "chrome/browser/chromeos/policy/device_local_account_policy_service.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
+#include "components/arc/arc_util.h"
 #else
 #include "chrome/browser/extensions/default_apps.h"
 #endif
@@ -66,6 +67,29 @@
 
 namespace extensions {
 
+namespace {
+
+#if defined(OS_CHROMEOS)
+
+// Certain default extensions are no longer needed on ARC devices as they were
+// replaced by their ARC counterparts.
+bool ShouldUninstallExtensionReplacedByArcApp(const std::string& extension_id) {
+  if (arc::IsWebstoreSearchEnabled())
+    return false;
+
+  if (extension_id == extension_misc::kGooglePlayBooksAppId ||
+      extension_id == extension_misc::kGooglePlayMoviesAppId ||
+      extension_id == extension_misc::kGooglePlayMusicAppId) {
+    return true;
+  }
+
+  return false;
+}
+
+#endif  // defined(OS_CHROMEOS)
+
+}  // namespace
+
 // Constants for keeping track of extension preferences in a dictionary.
 const char ExternalProviderImpl::kInstallParam[] = "install_parameter";
 const char ExternalProviderImpl::kExternalCrx[] = "external_crx";
@@ -191,6 +215,15 @@
     const std::string& extension_id = i.key();
     const base::DictionaryValue* extension = NULL;
 
+#if defined(OS_CHROMEOS)
+    if (ShouldUninstallExtensionReplacedByArcApp(extension_id)) {
+      VLOG(1) << "Extension with key: " << extension_id << " was replaced "
+              << "by a default ARC app, and will be uninstalled.";
+      unsupported_extensions.emplace(extension_id);
+      continue;
+    }
+#endif  // defined(OS_CHROMEOS)
+
     if (!crx_file::id_util::IdIsValid(extension_id)) {
       LOG(WARNING) << "Malformed extension dictionary: key "
                    << extension_id.c_str() << " is not a valid id.";

diff --git a/chrome/browser/extensions/user_script_listener.h b/chrome/browser/extensions/user_script_listener.h
index 2eeda6f..1a26db1 100644
--- a/chrome/browser/extensions/user_script_listener.h
+++ b/chrome/browser/extensions/user_script_listener.h

@@ -5,11 +5,11 @@
 #ifndef CHROME_BROWSER_EXTENSIONS_USER_SCRIPT_LISTENER_H_
 #define CHROME_BROWSER_EXTENSIONS_USER_SCRIPT_LISTENER_H_
 
-#include <deque>
 #include <list>
 #include <map>
 
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
@@ -87,8 +87,8 @@
 
   // Stores a throttle per URL request that we have delayed.
   class Throttle;
-  typedef base::WeakPtr<Throttle> WeakThrottle;
-  typedef std::deque<WeakThrottle> WeakThrottleList;
+  using WeakThrottle = base::WeakPtr<Throttle>;
+  using WeakThrottleList = base::circular_deque<WeakThrottle>;
   WeakThrottleList throttles_;
 
   // Per-profile bookkeeping so we know when all user scripts are ready.

diff --git a/chrome/browser/first_run/first_run.cc b/chrome/browser/first_run/first_run.cc
index 443fdac..2e6f45e 100644
--- a/chrome/browser/first_run/first_run.cc
+++ b/chrome/browser/first_run/first_run.cc

@@ -9,18 +9,15 @@
 #include <utility>
 
 #include "base/command_line.h"
-#include "base/compiler_specific.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
-#include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
-#include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
@@ -46,21 +43,17 @@
 #include "chrome/browser/ui/global_error/global_error_service.h"
 #include "chrome/browser/ui/global_error/global_error_service_factory.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/browser/ui/webui/ntp/new_tab_ui.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
-#include "chrome/grit/locale_settings.h"
 #include "chrome/installer/util/master_preferences.h"
 #include "chrome/installer/util/master_preferences_constants.h"
 #include "components/pref_registry/pref_registry_syncable.h"
 #include "components/prefs/pref_service.h"
 #include "components/search_engines/template_url_service.h"
 #include "components/signin/core/browser/signin_manager.h"
-#include "components/signin/core/browser/signin_tracker.h"
-#include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_service.h"
@@ -69,7 +62,6 @@
 #include "extensions/browser/extension_system.h"
 #include "extensions/common/one_shot_event.h"
 #include "google_apis/gaia/gaia_auth_util.h"
-#include "ui/base/l10n/l10n_util.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -590,20 +582,6 @@
 }
 
 bool IsOnWelcomePage(content::WebContents* contents) {
-  // We have to check both the GetURL() similar to the other checks below, but
-  // also the original request url because the welcome page we use is a
-  // redirect.
-  // TODO(crbug.com/651465): Remove this once kUseConsolidatedStartupFlow is on
-  // by default.
-  const GURL deprecated_welcome_page(
-      l10n_util::GetStringUTF8(IDS_WELCOME_PAGE_URL));
-  if (contents->GetURL() == deprecated_welcome_page ||
-      (contents->GetController().GetVisibleEntry() &&
-       contents->GetController().GetVisibleEntry()->GetOriginalRequestURL() ==
-           deprecated_welcome_page)) {
-    return true;
-  }
-
   const GURL welcome_page(chrome::kChromeUIWelcomeURL);
   const GURL welcome_page_win10(chrome::kChromeUIWelcomeWin10URL);
   const GURL current = contents->GetURL().GetWithEmptyPath();

diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 2038b17a..42fc3a2 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc

@@ -2467,6 +2467,11 @@
     "Change in lid angle (i.e. hinge between keyboard and screen) that must be "
     "met or exceeded for a power button event to be considered spurious.";
 
+const char kSysInternalsName[] = "Enable Sys-Internals";
+const char kSysInternalsDescription[] =
+    "If enabled, user can monitor system information at "
+    "chrome://sys-internals.";
+
 const char kTeamDrivesName[] = "Enable Team Drives Integration";
 const char kTeamDrivesDescription[] =
     "If enabled, files under Team Drives will appear in the Files app.";

diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 34a4701..d6fcf7d 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h

@@ -765,6 +765,9 @@
 extern const char kSyncSandboxName[];
 extern const char kSyncSandboxDescription[];
 
+extern const char kSysInternalsName[];
+extern const char kSysInternalsDescription[];
+
 extern const char kTabAudioMutingName[];
 extern const char kTabAudioMutingDescription[];
 

diff --git a/chrome/browser/hang_monitor/hang_crash_dump_win.cc b/chrome/browser/hang_monitor/hang_crash_dump_win.cc
index 9f30288..f36aa407 100644
--- a/chrome/browser/hang_monitor/hang_crash_dump_win.cc
+++ b/chrome/browser/hang_monitor/hang_crash_dump_win.cc

@@ -65,10 +65,10 @@
 
   HANDLE remote_thread = nullptr;
   if (send_remote_memory) {
-    remote_thread = InjectDumpForHungInput(hprocess, remote_memory);
+    remote_thread = InjectDumpForHungInput_ExportThunk(hprocess, remote_memory);
   } else {
-    remote_thread =
-        InjectDumpForHungInputNoCrashKeys(hprocess, crash_key_failure);
+    remote_thread = InjectDumpForHungInputNoCrashKeys_ExportThunk(
+        hprocess, crash_key_failure);
   }
   DCHECK(remote_thread) << "Failed creating remote thread: error "
                         << GetLastError();

diff --git a/chrome/browser/internal_auth.cc b/chrome/browser/internal_auth.cc
index 3a3894cf..d06f4df 100644
--- a/chrome/browser/internal_auth.cc
+++ b/chrome/browser/internal_auth.cc

@@ -8,11 +8,11 @@
 #include <stdint.h>
 
 #include <algorithm>
-#include <deque>
 #include <limits>
 #include <memory>
 
 #include "base/base64.h"
+#include "base/containers/circular_deque.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/rand_util.h"
@@ -227,7 +227,7 @@
     }
 
     // Record used tick to prevent reuse.
-    std::deque<int64_t>::iterator it =
+    base::circular_deque<int64_t>::iterator it =
         std::lower_bound(used_ticks_.begin(), used_ticks_.end(), tick);
     DCHECK(it == used_ticks_.end() || *it != tick);
     used_ticks_.insert(it, tick);
@@ -312,7 +312,7 @@
   // Keeps track of ticks of successfully verified passports to prevent their
   // reuse. Size of this container is kept reasonably low by purging outdated
   // ticks.
-  std::deque<int64_t> used_ticks_;
+  base::circular_deque<int64_t> used_ticks_;
 
   // Some ticks before |dark_tick_| were purged from |used_ticks_| container.
   // That means that we must not trust any tick less than or equal to dark tick.
@@ -423,7 +423,7 @@
 
   std::unique_ptr<crypto::HMAC> engine_;
   int64_t key_regeneration_tick_;
-  std::deque<int64_t> used_ticks_;
+  base::circular_deque<int64_t> used_ticks_;
 
   DISALLOW_COPY_AND_ASSIGN(InternalAuthGenerationService);
 };

diff --git a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
index 7c0132d1..c65ce977 100644
--- a/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc
+++ b/chrome/browser/loader/chrome_resource_dispatcher_host_delegate.cc

@@ -36,8 +36,6 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_io_data.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
-#include "chrome/browser/search/search.h"
-#include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "chrome/browser/signin/chrome_signin_helper.h"
 #include "chrome/browser/tab_contents/tab_util.h"
 #include "chrome/browser/ui/login/login_handler.h"
@@ -57,7 +55,6 @@
 #include "components/previews/core/previews_io_data.h"
 #include "components/rappor/public/rappor_utils.h"
 #include "components/rappor/rappor_service_impl.h"
-#include "components/search_engines/template_url_service.h"
 #include "components/variations/net/variations_http_headers.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_data.h"
@@ -297,64 +294,6 @@
 }
 #endif  // !defined(DISABLE_NACL)
 
-// This function is called in NotifyUIThreadOfRequestComplete to log metrics
-// about main frame resources.
-void LogMainFrameMetricsOnUIThread(const GURL& url,
-                                   int net_error,
-                                   base::TimeDelta request_loading_time,
-                                   content::WebContents* web_contents) {
-  DCHECK(web_contents);
-  Profile* profile =
-      Profile::FromBrowserContext(web_contents->GetBrowserContext());
-
-  // The rest of the function is only concerned about NTP metrics.
-  if (!profile || !search::IsNTPURL(url, profile))
-    return;
-
-  // A http/s scheme implies that the new tab page is remote. The local NTP is
-  // served from chrome-search://. To segment out remote NTPs, use the
-  // TemplateURLService to find the default search engine. Note that if the
-  // default search engine does not have a remote NTP, then the local NTP will
-  // be shown. As of April 2016, only Bing and Google have remote NTPs.
-  if (url.SchemeIsHTTPOrHTTPS()) {
-    TemplateURLService* template_url_service =
-        TemplateURLServiceFactory::GetForProfile(profile);
-    if (!template_url_service)
-      return;
-    const TemplateURL* default_provider =
-        template_url_service->GetDefaultSearchProvider();
-    if (!default_provider)
-      return;
-    if (default_provider->GetEngineType(
-            template_url_service->search_terms_data()) ==
-        SearchEngineType::SEARCH_ENGINE_GOOGLE) {
-      if (net_error == net::OK) {
-        UMA_HISTOGRAM_LONG_TIMES("Net.NTP.Google.RequestTime2.Success",
-                                 request_loading_time);
-      } else if (net_error == net::ERR_ABORTED) {
-        UMA_HISTOGRAM_LONG_TIMES("Net.NTP.Google.RequestTime2.ErrAborted",
-                                 request_loading_time);
-      }
-    } else {
-      if (net_error == net::OK) {
-        UMA_HISTOGRAM_LONG_TIMES("Net.NTP.ThirdParty.RequestTime2.Success",
-                                 request_loading_time);
-      } else if (net_error == net::ERR_ABORTED) {
-        UMA_HISTOGRAM_LONG_TIMES("Net.NTP.ThirdParty.RequestTime2.ErrAborted",
-                                 request_loading_time);
-      }
-    }
-  } else {
-    if (net_error == net::OK) {
-      UMA_HISTOGRAM_LONG_TIMES("Net.NTP.Local.RequestTime2.Success",
-                               request_loading_time);
-    } else if (net_error == net::ERR_ABORTED) {
-      UMA_HISTOGRAM_LONG_TIMES("Net.NTP.Local.RequestTime2.ErrAborted",
-                               request_loading_time);
-    }
-  }
-}
-
 #if BUILDFLAG(ENABLE_OFFLINE_PAGES)
 // Translate content::ResourceType to a type to use for Offliners.
 offline_pages::ResourceLoadingObserver::ResourceDataType
@@ -416,18 +355,12 @@
     int64_t raw_body_bytes,
     int64_t original_content_length,
     base::TimeTicks request_creation_time,
-    base::TimeDelta request_loading_time,
     std::unique_ptr<net::LoadTimingInfo> load_timing_info) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   content::WebContents* web_contents = web_contents_getter.Run();
   if (!web_contents)
     return;
 
-  if (resource_type == content::RESOURCE_TYPE_MAIN_FRAME) {
-    LogMainFrameMetricsOnUIThread(url, net_error, request_loading_time,
-                                  web_contents);
-  }
-
   if (!was_cached) {
     UpdatePrerenderNetworkBytesCallback(web_contents, total_received_bytes);
   }
@@ -949,7 +882,6 @@
           net_error, url_request->GetTotalReceivedBytes(),
           url_request->GetRawBodyBytes(), original_content_length,
           url_request->creation_time(),
-          base::TimeTicks::Now() - url_request->creation_time(),
           std::move(load_timing_info)));
 }
 

diff --git a/chrome/browser/media/media_engagement_service.cc b/chrome/browser/media/media_engagement_service.cc
index ade0489..9e46203 100644
--- a/chrome/browser/media/media_engagement_service.cc
+++ b/chrome/browser/media/media_engagement_service.cc

@@ -63,7 +63,7 @@
 
 // The current schema version of the MEI data. If this value is higher
 // than the stored value, all MEI data will be wiped.
-static const int kSchemaVersion = 1;
+static const int kSchemaVersion = 2;
 
 }  // namespace
 

diff --git a/chrome/browser/media/router/event_page_request_manager.cc b/chrome/browser/media/router/event_page_request_manager.cc
index c112d956..ee0b548 100644
--- a/chrome/browser/media/router/event_page_request_manager.cc
+++ b/chrome/browser/media/router/event_page_request_manager.cc

@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/containers/circular_deque.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "extensions/browser/event_page_tracker.h"
@@ -51,7 +52,7 @@
 
   mojo_connections_ready_ = true;
 
-  std::deque<base::OnceClosure> requests;
+  base::circular_deque<base::OnceClosure> requests;
   requests.swap(pending_requests_);
   for (base::OnceClosure& request : requests) {
     DCHECK(mojo_connections_ready_);

diff --git a/chrome/browser/media/router/event_page_request_manager.h b/chrome/browser/media/router/event_page_request_manager.h
index acadf9b..fe1d643d 100644
--- a/chrome/browser/media/router/event_page_request_manager.h
+++ b/chrome/browser/media/router/event_page_request_manager.h

@@ -5,10 +5,10 @@
 #ifndef CHROME_BROWSER_MEDIA_ROUTER_EVENT_PAGE_REQUEST_MANAGER_H_
 #define CHROME_BROWSER_MEDIA_ROUTER_EVENT_PAGE_REQUEST_MANAGER_H_
 
-#include <deque>
 #include <string>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/media/router/mojo/media_router_mojo_metrics.h"
@@ -117,7 +117,7 @@
 
   // Pending requests queued to be executed once component extension
   // becomes ready.
-  std::deque<base::OnceClosure> pending_requests_;
+  base::circular_deque<base::OnceClosure> pending_requests_;
 
   // Allows the extension to be monitored for suspend, and woken.
   // This is a reference to a BrowserContext keyed service that outlives this

diff --git a/chrome/browser/media/router/mojo/media_router_mojo_impl.h b/chrome/browser/media/router/mojo/media_router_mojo_impl.h
index 0af9b77..1f5606b5 100644
--- a/chrome/browser/media/router/mojo/media_router_mojo_impl.h
+++ b/chrome/browser/media/router/mojo/media_router_mojo_impl.h

@@ -7,7 +7,6 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <map>
 #include <memory>
 #include <set>

diff --git a/chrome/browser/media/webrtc/desktop_media_list_base.cc b/chrome/browser/media/webrtc/desktop_media_list_base.cc
index ffe8f3f2..6c69a4b 100644
--- a/chrome/browser/media/webrtc/desktop_media_list_base.cc
+++ b/chrome/browser/media/webrtc/desktop_media_list_base.cc

@@ -141,7 +141,6 @@
 // static
 uint32_t DesktopMediaListBase::GetImageHash(const gfx::Image& image) {
   SkBitmap bitmap = image.AsBitmap();
-  uint32_t value =
-      base::Hash(reinterpret_cast<char*>(bitmap.getPixels()), bitmap.getSize());
+  uint32_t value = base::Hash(bitmap.getPixels(), bitmap.getSize());
   return value;
 }

diff --git a/chrome/browser/media/webrtc/media_capture_devices_dispatcher.h b/chrome/browser/media/webrtc/media_capture_devices_dispatcher.h
index 4100db1..82c6a0b 100644
--- a/chrome/browser/media/webrtc/media_capture_devices_dispatcher.h
+++ b/chrome/browser/media/webrtc/media_capture_devices_dispatcher.h

@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_MEDIA_WEBRTC_MEDIA_CAPTURE_DEVICES_DISPATCHER_H_
 #define CHROME_BROWSER_MEDIA_WEBRTC_MEDIA_CAPTURE_DEVICES_DISPATCHER_H_
 
-#include <deque>
 #include <list>
 #include <map>
 #include <memory>

diff --git a/chrome/browser/media/webrtc/native_desktop_media_list.cc b/chrome/browser/media/webrtc/native_desktop_media_list.cc
index 34940036..87ba07f 100644
--- a/chrome/browser/media/webrtc/native_desktop_media_list.cc
+++ b/chrome/browser/media/webrtc/native_desktop_media_list.cc

@@ -43,7 +43,7 @@
 // media source has changed.
 uint32_t GetFrameHash(webrtc::DesktopFrame* frame) {
   int data_size = frame->stride() * frame->size().height();
-  return base::Hash(reinterpret_cast<char*>(frame->data()), data_size);
+  return base::Hash(frame->data(), data_size);
 }
 
 gfx::ImageSkia ScaleDesktopFrame(std::unique_ptr<webrtc::DesktopFrame> frame,

diff --git a/chrome/browser/media/webrtc/permission_bubble_media_access_handler.h b/chrome/browser/media/webrtc/permission_bubble_media_access_handler.h
index 81fd4a8..66a91eb 100644
--- a/chrome/browser/media/webrtc/permission_bubble_media_access_handler.h
+++ b/chrome/browser/media/webrtc/permission_bubble_media_access_handler.h

@@ -5,9 +5,9 @@
 #ifndef CHROME_BROWSER_MEDIA_WEBRTC_PERMISSION_BUBBLE_MEDIA_ACCESS_HANDLER_H_
 #define CHROME_BROWSER_MEDIA_WEBRTC_PERMISSION_BUBBLE_MEDIA_ACCESS_HANDLER_H_
 
-#include <deque>
 #include <map>
 
+#include "base/containers/circular_deque.h"
 #include "chrome/browser/media/media_access_handler.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
@@ -41,8 +41,8 @@
 
  private:
   struct PendingAccessRequest;
-  typedef std::deque<PendingAccessRequest> RequestsQueue;
-  typedef std::map<content::WebContents*, RequestsQueue> RequestsQueues;
+  using RequestsQueue = base::circular_deque<PendingAccessRequest>;
+  using RequestsQueues = std::map<content::WebContents*, RequestsQueue>;
 
   void ProcessQueuedAccessRequest(content::WebContents* web_contents);
   void OnAccessRequestResponse(content::WebContents* web_contents,

diff --git a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc
index a6f37c07..0990e47 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc
+++ b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.cc

@@ -15,6 +15,7 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/containers/circular_deque.h"
 #include "base/files/file_util.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
@@ -1580,7 +1581,7 @@
   MTPFileNode* dir_node = it->second;
 
   // Traverse the MTPFileNode tree to reconstuct the full path for |dir_id|.
-  std::deque<std::string> dir_path_parts;
+  base::circular_deque<std::string> dir_path_parts;
   MTPFileNode* parent_node = dir_node;
   while (parent_node->parent()) {
     dir_path_parts.push_front(parent_node->file_name());

diff --git a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h
index 7a4c63a7..3bd4773a 100644
--- a/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h
+++ b/chrome/browser/media_galleries/chromeos/mtp_device_delegate_impl_chromeos.h

@@ -7,13 +7,13 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <map>
 #include <memory>
 #include <set>
 #include <string>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/files/file_path.h"
 #include "base/location.h"
 #include "base/macros.h"
@@ -493,7 +493,7 @@
 
   // A list of pending tasks that needs to be run when the device is
   // initialized or when the current task in progress is complete.
-  std::deque<PendingTaskInfo> pending_tasks_;
+  base::circular_deque<PendingTaskInfo> pending_tasks_;
 
   // Used to track the current snapshot file request. A snapshot file is created
   // incrementally. CreateSnapshotFile request reads the device file and writes

diff --git a/chrome/browser/metrics/android_metrics_provider.cc b/chrome/browser/metrics/android_metrics_provider.cc
index 0e01c89..a46cc7e 100644
--- a/chrome/browser/metrics/android_metrics_provider.cc
+++ b/chrome/browser/metrics/android_metrics_provider.cc

@@ -11,8 +11,9 @@
 namespace {
 
 void EmitLowRamDeviceHistogram() {
-  UMA_HISTOGRAM_BOOLEAN("MemoryAndroid.LowRamDevice",
-                        base::SysInfo::IsLowEndDevice());
+  // Equivalent to UMA_HISTOGRAM_BOOLEAN with the stability flag set.
+  UMA_STABILITY_HISTOGRAM_ENUMERATION(
+      "MemoryAndroid.LowRamDevice", base::SysInfo::IsLowEndDevice() ? 1 : 0, 2);
 }
 
 }  // namespace

diff --git a/chrome/browser/metrics/chrome_metrics_service_client.h b/chrome/browser/metrics/chrome_metrics_service_client.h
index e90b3b6..3f55f6f 100644
--- a/chrome/browser/metrics/chrome_metrics_service_client.h
+++ b/chrome/browser/metrics/chrome_metrics_service_client.h

@@ -7,12 +7,12 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <memory>
 #include <queue>
 #include <string>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/sequence_checker.h"
@@ -182,7 +182,7 @@
 
   // A queue of tasks for initial metrics gathering. These may be asynchronous
   // or synchronous.
-  std::deque<base::Closure> initialize_task_queue_;
+  base::circular_deque<base::Closure> initialize_task_queue_;
 
   // Saved callback received from CollectFinalMetricsForLog().
   base::Closure collect_final_metrics_done_callback_;

diff --git a/chrome/browser/metrics/chrome_metrics_services_manager_client.cc b/chrome/browser/metrics/chrome_metrics_services_manager_client.cc
index b39e352..f00964e 100644
--- a/chrome/browser/metrics/chrome_metrics_services_manager_client.cc
+++ b/chrome/browser/metrics/chrome_metrics_services_manager_client.cc

@@ -265,7 +265,7 @@
   // Crashpad will use the kRegUsageStatsInSample registry value to apply
   // sampling correctly, but may_record already reflects the sampling state.
   // This isn't a problem though, since they will be consistent.
-  SetUploadConsentImpl(may_record && may_upload);
+  SetUploadConsent_ExportThunk(may_record && may_upload);
 }
 #endif  // defined(OS_WIN)
 

diff --git a/chrome/browser/metrics/process_memory_metrics_emitter.cc b/chrome/browser/metrics/process_memory_metrics_emitter.cc
index 5d493e6d..0169163f 100644
--- a/chrome/browser/metrics/process_memory_metrics_emitter.cc
+++ b/chrome/browser/metrics/process_memory_metrics_emitter.cc

@@ -248,10 +248,8 @@
     private_footprint_total_kb += pmd->os_dump->private_footprint_kb;
     switch (pmd->process_type) {
       case memory_instrumentation::mojom::ProcessType::BROWSER: {
-        // Create a separate source for each non-renderer process type.
-        ukm::SourceId source_id = ukm::UkmRecorder::GetNewSourceID();
-        ukm::UkmRecorder::Get()->UpdateSourceURL(source_id, GURL());
-        EmitBrowserMemoryMetrics(pmd, source_id, GetUkmRecorder());
+        EmitBrowserMemoryMetrics(pmd, ukm::UkmRecorder::GetNewSourceID(),
+                                 GetUkmRecorder());
         break;
       }
       case memory_instrumentation::mojom::ProcessType::RENDERER: {
@@ -272,10 +270,8 @@
         break;
       }
       case memory_instrumentation::mojom::ProcessType::GPU: {
-        // Create a separate source for each non-renderer process type.
-        ukm::SourceId source_id = ukm::UkmRecorder::GetNewSourceID();
-        ukm::UkmRecorder::Get()->UpdateSourceURL(source_id, GURL());
-        EmitGpuMemoryMetrics(pmd, source_id, GetUkmRecorder());
+        EmitGpuMemoryMetrics(pmd, ukm::UkmRecorder::GetNewSourceID(),
+                             GetUkmRecorder());
         break;
       }
       case memory_instrumentation::mojom::ProcessType::UTILITY:
@@ -290,9 +286,7 @@
   UMA_HISTOGRAM_MEMORY_LARGE_MB("Memory.Total.PrivateMemoryFootprint",
                                 private_footprint_total_kb / 1024);
 
-  ukm::SourceId source_id = ukm::UkmRecorder::GetNewSourceID();
-  ukm::UkmRecorder::Get()->UpdateSourceURL(source_id, GURL());
-  ukm::builders::Memory_Experimental(source_id)
+  ukm::builders::Memory_Experimental(ukm::UkmRecorder::GetNewSourceID())
       .SetTotal2_PrivateMemoryFootprint(private_footprint_total_kb / 1024)
       .Record(GetUkmRecorder());
 }

diff --git a/chrome/browser/metrics/process_memory_metrics_emitter_browsertest.cc b/chrome/browser/metrics/process_memory_metrics_emitter_browsertest.cc
index 5971506..5fcd59e 100644
--- a/chrome/browser/metrics/process_memory_metrics_emitter_browsertest.cc
+++ b/chrome/browser/metrics/process_memory_metrics_emitter_browsertest.cc

@@ -217,68 +217,41 @@
   void CheckAllUkmSources(size_t metric_count = 1u) {
     const std::map<ukm::SourceId, std::unique_ptr<ukm::UkmSource>>& sources =
         test_ukm_recorder_->GetSources();
-    ASSERT_NE(0U, test_ukm_recorder_->entries_count());
-    ASSERT_NE(0U, test_ukm_recorder_->sources_count());
-    size_t browser_count = 0;
-    size_t renderer_count = 0;
     for (auto& pair : sources) {
       const ukm::UkmSource* source = pair.second.get();
       if (ProcessHasTypeForSource(source, ProcessType::BROWSER)) {
-        CheckUkmBrowserSource(source, 1);
-        ++browser_count;
+        CheckUkmBrowserSource(source, metric_count);
       } else if (ProcessHasTypeForSource(source, ProcessType::RENDERER)) {
         CheckUkmRendererSource(source, metric_count);
-        ++renderer_count;
-      } else if (ProcessHasTypeForSource(source, ProcessType::GPU)) {
-        CheckMemoryMetricWithName(source, "Malloc", false, 1);
-        CheckMemoryMetricWithName(source, "PrivateMemoryFootprint", false, 1);
       } else {
         // This must be Total2.
         CheckMemoryMetricWithName(source, "Total2.PrivateMemoryFootprint",
-                                  false, 1);
+                                  false, metric_count);
       }
     }
-
-    // Each browser process is given a new source, so we expect |metric_count|
-    // of them.
-    ASSERT_EQ(browser_count, metric_count);
-
-    // Each renderer should be navigated to the same URL, so we expect exactly
-    // one source. However, temporary renderers might cause there to be multiple
-    // sources.
-    ASSERT_GE(renderer_count, 1u);
   }
 
   void CheckMemoryMetricWithName(const ukm::UkmSource* source,
                                  const char* name,
                                  bool can_be_zero,
-                                 size_t metric_count = 1u,
-                                 bool metric_count_can_double = false) {
+                                 size_t metric_count = 1u) {
     std::vector<int64_t> metrics =
         test_ukm_recorder_->GetMetrics(*source, UkmEventName, name);
-    if (metric_count_can_double) {
-      ASSERT_TRUE(metrics.size() >= metric_count &&
-                  metrics.size() <= 2 * metric_count)
-          << name << " " << metrics.size();
-    } else {
-      ASSERT_EQ(metric_count, metrics.size()) << name;
-    }
+    EXPECT_EQ(metric_count, metrics.size());
     EXPECT_GE(metrics[0], can_be_zero ? 0 : 1) << name;
     EXPECT_LE(metrics[0], 4000) << name;
   }
 
   void CheckUkmRendererSource(const ukm::UkmSource* source,
                               size_t metric_count = 1u) {
-    CheckMemoryMetricWithName(source, "Malloc", false, metric_count, true);
-    CheckMemoryMetricWithName(source, "Resident", false, metric_count, true);
+    CheckMemoryMetricWithName(source, "Malloc", false, metric_count);
+    CheckMemoryMetricWithName(source, "Resident", false, metric_count);
     CheckMemoryMetricWithName(source, "PrivateMemoryFootprint", false,
-                              metric_count, true);
-    CheckMemoryMetricWithName(source, "BlinkGC", true, metric_count, true);
-    CheckMemoryMetricWithName(source, "PartitionAlloc", true, metric_count,
-                              true);
-    CheckMemoryMetricWithName(source, "V8", true, metric_count, true);
-    CheckMemoryMetricWithName(source, "NumberOfExtensions", true, metric_count,
-                              true);
+                              metric_count);
+    CheckMemoryMetricWithName(source, "BlinkGC", true, metric_count);
+    CheckMemoryMetricWithName(source, "PartitionAlloc", true, metric_count);
+    CheckMemoryMetricWithName(source, "V8", true, metric_count);
+    CheckMemoryMetricWithName(source, "NumberOfExtensions", true, metric_count);
   }
 
   void CheckUkmBrowserSource(const ukm::UkmSource* source,

diff --git a/chrome/browser/net/network_context_configuration_browsertest.cc b/chrome/browser/net/network_context_configuration_browsertest.cc
index b350fb5a..4a8ef218 100644
--- a/chrome/browser/net/network_context_configuration_browsertest.cc
+++ b/chrome/browser/net/network_context_configuration_browsertest.cc

@@ -266,7 +266,7 @@
   // Make a request whose response should be cached.
   content::ResourceRequest request;
   request.url = test_url;
-  request.headers = "foo: foopity foo\r\n\r\n";
+  request.headers.SetHeader("foo", "foopity foo");
   simple_loader->DownloadToStringOfUnboundedSizeUntilCrashAndDie(
       request, loader_factory(), TRAFFIC_ANNOTATION_FOR_TESTS,
       simple_loader_helper.GetCallback());

diff --git a/chrome/browser/notifications/notification_interactive_uitest.cc b/chrome/browser/notifications/notification_interactive_uitest.cc
index fc3890dd..7fd8a27 100644
--- a/chrome/browser/notifications/notification_interactive_uitest.cc
+++ b/chrome/browser/notifications/notification_interactive_uitest.cc

@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include <deque>
 #include <string>
 
 #include "base/bind.h"

diff --git a/chrome/browser/notifications/notification_permission_context.cc b/chrome/browser/notifications/notification_permission_context.cc
index 5ad3943..d3cd3690 100644
--- a/chrome/browser/notifications/notification_permission_context.cc
+++ b/chrome/browser/notifications/notification_permission_context.cc

@@ -4,9 +4,8 @@
 
 #include "chrome/browser/notifications/notification_permission_context.h"
 
-#include <deque>
-
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/location.h"
 #include "base/rand_util.h"
 #include "base/single_thread_task_runner.h"
@@ -62,6 +61,10 @@
     Task(const PermissionRequestID& id, std::unique_ptr<base::Timer> timer)
         : id(id), timer(std::move(timer)) {}
 
+    // Move-only.
+    Task(Task&&) noexcept = default;
+    Task(const Task&) = delete;
+
     Task& operator=(Task&& other) {
       id = other.id;
       timer = std::move(other.timer);
@@ -70,11 +73,8 @@
 
     PermissionRequestID id;
     std::unique_ptr<base::Timer> timer;
-
-   private:
-    DISALLOW_COPY_AND_ASSIGN(Task);
   };
-  std::deque<Task> task_queue_;
+  base::circular_deque<Task> task_queue_;
 
   DISALLOW_COPY_AND_ASSIGN(VisibilityTimerTabHelper);
 };

diff --git a/chrome/browser/permissions/permission_request_manager.cc b/chrome/browser/permissions/permission_request_manager.cc
index 10ab050..83a0577 100644
--- a/chrome/browser/permissions/permission_request_manager.cc
+++ b/chrome/browser/permissions/permission_request_manager.cc

@@ -7,6 +7,7 @@
 #include <algorithm>
 
 #include "base/command_line.h"
+#include "base/containers/circular_deque.h"
 #include "base/feature_list.h"
 #include "base/metrics/user_metrics.h"
 #include "base/metrics/user_metrics_action.h"
@@ -183,7 +184,7 @@
 void PermissionRequestManager::CancelRequest(PermissionRequest* request) {
   // First look in the queued requests, where we can simply finish the request
   // and go on.
-  std::deque<PermissionRequest*>::iterator queued_requests_iter;
+  base::circular_deque<PermissionRequest*>::iterator queued_requests_iter;
   for (queued_requests_iter = queued_requests_.begin();
        queued_requests_iter != queued_requests_.end(); queued_requests_iter++) {
     if (*queued_requests_iter == request) {
@@ -435,12 +436,8 @@
 }
 
 void PermissionRequestManager::CleanUpRequests() {
-  std::deque<PermissionRequest*>::iterator requests_iter;
-  for (requests_iter = queued_requests_.begin();
-       requests_iter != queued_requests_.end();
-       requests_iter++) {
-    RequestFinishedIncludingDuplicates(*requests_iter);
-  }
+  for (PermissionRequest* request : queued_requests_)
+    RequestFinishedIncludingDuplicates(request);
   queued_requests_.clear();
 
   if (!requests_.empty())
@@ -449,12 +446,14 @@
 
 PermissionRequest* PermissionRequestManager::GetExistingRequest(
     PermissionRequest* request) {
-  for (PermissionRequest* existing_request : requests_)
+  for (PermissionRequest* existing_request : requests_) {
     if (IsMessageTextEqual(existing_request, request))
       return existing_request;
-  for (PermissionRequest* existing_request : queued_requests_)
+  }
+  for (PermissionRequest* existing_request : queued_requests_) {
     if (IsMessageTextEqual(existing_request, request))
       return existing_request;
+  }
   return nullptr;
 }
 

diff --git a/chrome/browser/permissions/permission_request_manager.h b/chrome/browser/permissions/permission_request_manager.h
index b6d0ab0..864a60b 100644
--- a/chrome/browser/permissions/permission_request_manager.h
+++ b/chrome/browser/permissions/permission_request_manager.h

@@ -5,9 +5,9 @@
 #ifndef CHROME_BROWSER_PERMISSIONS_PERMISSION_REQUEST_MANAGER_H_
 #define CHROME_BROWSER_PERMISSIONS_PERMISSION_REQUEST_MANAGER_H_
 
-#include <deque>
 #include <unordered_map>
 
+#include "base/containers/circular_deque.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
@@ -196,7 +196,7 @@
   bool tab_can_show_prompts_;
 
   std::vector<PermissionRequest*> requests_;
-  std::deque<PermissionRequest*> queued_requests_;
+  base::circular_deque<PermissionRequest*> queued_requests_;
   // Maps from the first request of a kind to subsequent requests that were
   // duped against it.
   std::unordered_multimap<PermissionRequest*, PermissionRequest*>

diff --git a/chrome/browser/prerender/prerender_browsertest.cc b/chrome/browser/prerender/prerender_browsertest.cc
index 1a95b2e..5f570b07 100644
--- a/chrome/browser/prerender/prerender_browsertest.cc
+++ b/chrome/browser/prerender/prerender_browsertest.cc

@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 #include <stddef.h>
-#include <deque>
 #include <set>
 #include <string>
 #include <unordered_map>

diff --git a/chrome/browser/prerender/prerender_test_utils.h b/chrome/browser/prerender/prerender_test_utils.h
index 227ba7b6..5e5db55 100644
--- a/chrome/browser/prerender/prerender_test_utils.h
+++ b/chrome/browser/prerender/prerender_test_utils.h

@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_PRERENDER_PRERENDER_TEST_UTILS_H_
 #define CHROME_BROWSER_PRERENDER_PRERENDER_TEST_UTILS_H_
 
-#include <deque>
 #include <functional>
 #include <memory>
 #include <set>
@@ -13,6 +12,7 @@
 #include <unordered_map>
 #include <vector>
 
+#include "base/containers/circular_deque.h"
 #include "base/memory/weak_ptr.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
@@ -291,7 +291,7 @@
     base::WeakPtr<TestPrerender> handle;
   };
 
-  std::deque<ExpectedContents> expected_contents_queue_;
+  base::circular_deque<ExpectedContents> expected_contents_queue_;
 
   DISALLOW_COPY_AND_ASSIGN(TestPrerenderContentsFactory);
 };

diff --git a/chrome/browser/process_resource_usage.h b/chrome/browser/process_resource_usage.h
index aa8cd10cd..3a2c073 100644
--- a/chrome/browser/process_resource_usage.h
+++ b/chrome/browser/process_resource_usage.h

@@ -7,9 +7,8 @@
 
 #include <stddef.h>
 
-#include <deque>
-
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/threading/thread_checker.h"
 #include "chrome/common/resource_usage_reporter.mojom.h"
@@ -82,7 +81,7 @@
 
   chrome::mojom::ResourceUsageReporterPtr service_;
   bool update_in_progress_;
-  std::deque<base::Closure> refresh_callbacks_;
+  base::circular_deque<base::Closure> refresh_callbacks_;
 
   chrome::mojom::ResourceUsageDataPtr stats_;
 

diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
index 460098e..0886548 100644
--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc

@@ -1015,14 +1015,12 @@
                                    supervised_user_id);
   }
 #if !defined(OS_ANDROID)
-  if (StartupBrowserCreator::UseConsolidatedFlow()) {
-    // TODO(pmonette): Fix IsNewProfile() to handle the case where the profile
-    // is new even if the "Preferences" file already existed (For example: The
-    // master_preferences file is dumped into the default profile on first run,
-    // before profile creation).
-    if (profile->IsNewProfile() || first_run::IsChromeFirstRun())
-      profile->GetPrefs()->SetBoolean(prefs::kHasSeenWelcomePage, false);
-  }
+  // TODO(pmonette): Fix IsNewProfile() to handle the case where the profile is
+  // new even if the "Preferences" file already existed. (For example: The
+  // master_preferences file is dumped into the default profile on first run,
+  // before profile creation.)
+  if (profile->IsNewProfile() || first_run::IsChromeFirstRun())
+    profile->GetPrefs()->SetBoolean(prefs::kHasSeenWelcomePage, false);
 #endif
 }
 

diff --git a/chrome/browser/profiles/profile_manager_unittest.cc b/chrome/browser/profiles/profile_manager_unittest.cc
index 92d0f64..b795da2c 100644
--- a/chrome/browser/profiles/profile_manager_unittest.cc
+++ b/chrome/browser/profiles/profile_manager_unittest.cc

@@ -60,6 +60,7 @@
 #include "chromeos/chromeos_switches.h"
 #include "components/user_manager/user_manager.h"
 #include "components/user_manager/user_names.h"
+#include "extensions/common/features/feature_session_type.h"
 #endif  // defined(OS_CHROMEOS)
 
 using base::ASCIIToUTF16;
@@ -141,6 +142,13 @@
     base::CommandLine* cl = base::CommandLine::ForCurrentProcess();
     cl->AppendSwitch(switches::kTestType);
     chromeos::WallpaperManager::Initialize();
+
+    // Have to manually reset the session type in between test runs because
+    // some tests log in users.
+    ASSERT_EQ(extensions::FeatureSessionType::INITIAL,
+              extensions::GetCurrentFeatureSessionType());
+    session_type_ = extensions::ScopedCurrentFeatureSessionType(
+        extensions::GetCurrentFeatureSessionType());
 #endif
   }
 
@@ -148,6 +156,7 @@
     TestingBrowserProcess::GetGlobal()->SetProfileManager(NULL);
     content::RunAllBlockingPoolTasksUntilIdle();
 #if defined(OS_CHROMEOS)
+    session_type_.reset();
     chromeos::WallpaperManager::Shutdown();
 #endif
   }
@@ -220,6 +229,8 @@
 
 #if defined(OS_CHROMEOS)
   chromeos::ScopedTestUserManager test_user_manager_;
+  std::unique_ptr<base::AutoReset<extensions::FeatureSessionType>>
+      session_type_;
 #endif
 
   DISALLOW_COPY_AND_ASSIGN(ProfileManagerTest);
@@ -582,6 +593,13 @@
     cl->AppendSwitch(::switches::kIncognito);
 
     chromeos::WallpaperManager::Initialize();
+    // Have to manually reset the session type in between test runs because
+    // RegisterUser() changes it.
+    ASSERT_EQ(extensions::FeatureSessionType::INITIAL,
+              extensions::GetCurrentFeatureSessionType());
+    session_type_ = extensions::ScopedCurrentFeatureSessionType(
+        extensions::GetCurrentFeatureSessionType());
+
     RegisterUser(user_manager::kGuestUserName);
 #endif
   }

diff --git a/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.cc b/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.cc
index c209e484..425f822 100644
--- a/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.cc
+++ b/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.cc

@@ -143,7 +143,7 @@
   }
 
   if (navigation_handle->IsInMainFrame()) {
-    UpdateUkmRecorder(navigation_handle);
+    UpdateUkmRecorder(navigation_handle->GetNavigationId());
     ResetFlag();
     tab_resource_coordinator_->SendEvent(
         resource_coordinator::mojom::Event::kNavigationCommitted);
@@ -183,16 +183,13 @@
 }
 
 void ResourceCoordinatorWebContentsObserver::UpdateUkmRecorder(
-    content::NavigationHandle* handle) {
+    int64_t navigation_id) {
   if (!base::FeatureList::IsEnabled(ukm::kUkmFeature)) {
     return;
   }
 
-  ukm_source_id_ = ukm::ConvertToSourceId(handle->GetNavigationId(),
-                                          ukm::SourceIdType::NAVIGATION_ID);
-  ukm::UkmRecorder* ukm_recorder = ukm::UkmRecorder::Get();
-  if (ukm_recorder)
-    ukm_recorder->UpdateSourceURL(ukm_source_id_, handle->GetURL());
+  ukm_source_id_ =
+      ukm::ConvertToSourceId(navigation_id, ukm::SourceIdType::NAVIGATION_ID);
   tab_resource_coordinator_->SetProperty(
       resource_coordinator::mojom::PropertyType::kUKMSourceId, ukm_source_id_);
 }

diff --git a/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.h b/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.h
index 3365c8e..fc02cae 100644
--- a/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.h
+++ b/chrome/browser/resource_coordinator/resource_coordinator_web_contents_observer.h

@@ -44,7 +44,7 @@
 
   void EnsureUkmRecorderInterface();
   void MaybeSetUkmRecorderInterface(bool ukm_recorder_already_initialized);
-  void UpdateUkmRecorder(content::NavigationHandle* handle);
+  void UpdateUkmRecorder(int64_t navigation_id);
 
  private:
   explicit ResourceCoordinatorWebContentsObserver(

diff --git a/chrome/browser/resources/chromeos/login/screen_arc_terms_of_service.css b/chrome/browser/resources/chromeos/login/screen_arc_terms_of_service.css
index a05512a..021e65e0 100644
--- a/chrome/browser/resources/chromeos/login/screen_arc_terms_of_service.css
+++ b/chrome/browser/resources/chromeos/login/screen_arc_terms_of_service.css

@@ -13,6 +13,14 @@
   padding: unset;
 }
 
+#arc-tos[md-mode] .arc-tos-overlay-close-bottom {
+  display: none;
+}
+
+#arc-tos[md-mode] .popup-overlay {
+  background: rgba(0, 0, 0, .5);
+}
+
 #arc-tos .step-contents {
   -webkit-margin-start: 32px;
   margin-bottom: 49px;

diff --git a/chrome/browser/resources/settings/bluetooth_page/bluetooth_page.js b/chrome/browser/resources/settings/bluetooth_page/bluetooth_page.js
index 35b5c439..a626139 100644
--- a/chrome/browser/resources/settings/bluetooth_page/bluetooth_page.js
+++ b/chrome/browser/resources/settings/bluetooth_page/bluetooth_page.js

@@ -25,6 +25,8 @@
 Polymer({
   is: 'settings-bluetooth-page',
 
+  behaviors: [PrefsBehavior],
+
   properties: {
     /** Preferences state. */
     prefs: {
@@ -166,6 +168,7 @@
     this.adapterState_ = state;
     this.bluetoothToggleState_ = state.powered;
     this.bluetoothToggleDisabled_ = !state.available;
+    this.setPrefValue('ash.user.bluetooth.adapter_enabled', state.powered);
   },
 
   /** @private */

diff --git a/chrome/browser/resources/settings/bluetooth_page/compiled_resources2.gyp b/chrome/browser/resources/settings/bluetooth_page/compiled_resources2.gyp
index 3d4051ba..975856e1 100644
--- a/chrome/browser/resources/settings/bluetooth_page/compiled_resources2.gyp
+++ b/chrome/browser/resources/settings/bluetooth_page/compiled_resources2.gyp

@@ -7,6 +7,7 @@
       'target_name': 'bluetooth_page',
       'dependencies': [
         '../compiled_resources2.gyp:route',
+        '../prefs/compiled_resources2.gyp:prefs_behavior',
         '../settings_page/compiled_resources2.gyp:settings_animated_pages',
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:assert',
         '<(DEPTH)/ui/webui/resources/js/compiled_resources2.gyp:i18n_behavior',

diff --git a/chrome/browser/resources/sys_internals/index.css b/chrome/browser/resources/sys_internals/index.css
new file mode 100644
index 0000000..850e597
--- /dev/null
+++ b/chrome/browser/resources/sys_internals/index.css

@@ -0,0 +1,4 @@
+/** Copyright 2017 The Chromium Authors. All rights reserved.
+  * Use of this source code is governed by a BSD-style license that can be
+  * found in the LICENSE file.
+**/

diff --git a/chrome/browser/resources/sys_internals/index.html b/chrome/browser/resources/sys_internals/index.html
new file mode 100644
index 0000000..1c86fba7
--- /dev/null
+++ b/chrome/browser/resources/sys_internals/index.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<!--
+Copyright 2017 The Chromium Authors. All rights reserved.
+Use of this source code is governed by a BSD-style license that can be
+found in the LICENSE file.
+-->
+<head>
+  <title>System Internals</title>
+  <link rel="stylesheet" type="text/css" href="index.css">
+  <script src="chrome://resources/js/cr.js"></script>
+  <script src="chrome://resources/js/promise_resolver.js"></script>
+  <script src="chrome://resources/js/util.js"></script>
+  <script type="text/javascript" src="index.js"></script>
+</head>
+<body>
+</body>
+</html>

diff --git a/chrome/browser/resources/sys_internals/index.js b/chrome/browser/resources/sys_internals/index.js
new file mode 100644
index 0000000..60b11b8
--- /dev/null
+++ b/chrome/browser/resources/sys_internals/index.js

@@ -0,0 +1,3 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc
index b0a6baf..e2f9d7ff 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc

@@ -5,7 +5,9 @@
 #include "chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h"
 
 #include <initializer_list>
+#include <map>
 #include <set>
+#include <tuple>
 #include <utility>
 #include <vector>
 
@@ -40,29 +42,42 @@
 #include "components/component_updater/pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "components/safe_browsing/common/safe_browsing_prefs.h"
+#include "components/variations/variations_params_manager.h"
 
 namespace safe_browsing {
 
 namespace {
 
+constexpr char kSRTPromptGroup[] = "SRTGroup";
+
 // Parameter for this test:
-//  - bool in_browser_cleaner_ui: indicates if InBrowserCleanerUI feature
+//  - bool in_browser_cleaner_ui_: indicates if InBrowserCleanerUI feature
 //    is enabled;
 //
 //    We expect that the reporter's logic should remain unchanged even when the
 //    InBrowserCleanerUI feature is enabled with one exception: the reporter is
 //    not run daily because with the new feature enabled there is no concept of
 //    a pending prompt. See the RunDaily and InBrowserUINoRunDaily tests.
+//  - const char* old_seed_: The old "Seed" Finch parameter saved in prefs.
+//  - const char* incoming_seed_: The new "Seed" Finch parameter.
 class ReporterRunnerTest : public InProcessBrowserTest,
                            public SwReporterTestingDelegate,
-                           public ::testing::WithParamInterface<bool> {
+                           public ::testing::WithParamInterface<
+                               testing::tuple<bool, const char*, const char*>> {
  public:
-  ReporterRunnerTest() = default;
+  ReporterRunnerTest() {
+    std::tie(in_browser_cleaner_ui_, old_seed_, incoming_seed_) = GetParam();
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    variations::testing::VariationParamsManager::AppendVariationParams(
+        kSRTPromptTrial, kSRTPromptGroup, {{"Seed", incoming_seed_}},
+        command_line);
+  }
 
   void SetUpInProcessBrowserTestFixture() override {
     SetSwReporterTestingDelegate(this);
 
-    in_browser_cleaner_ui_ = GetParam();
     if (in_browser_cleaner_ui_)
       scoped_feature_list_.InitAndEnableFeature(kInBrowserCleanerUIFeature);
     else
@@ -81,6 +96,9 @@
         base::TimeDelta::FromDays(kDaysBetweenSuccessfulSwReporterRuns * 2));
 
     ClearLastTimeSentReport();
+
+    chrome::FindLastActive()->profile()->GetPrefs()->SetString(
+        prefs::kSwReporterPromptSeed, old_seed_);
   }
 
   void TearDownOnMainThread() override {
@@ -272,7 +290,10 @@
   // The task runner that was in use before installing |mock_time_task_runner_|.
   scoped_refptr<base::SingleThreadTaskRunner> saved_task_runner_;
 
+  // Test parameters.
   bool in_browser_cleaner_ui_;
+  std::string old_seed_;
+  std::string incoming_seed_;
 
   bool prompt_trigger_called_ = false;
   int reporter_launch_count_ = 0;
@@ -312,8 +333,11 @@
 }
 
 IN_PROC_BROWSER_TEST_P(ReporterRunnerTest, CleanupNeeded) {
+  bool expect_prompt =
+      incoming_seed_.empty() ? true : incoming_seed_ != old_seed_;
+
   RunReporter(chrome_cleaner::kSwReporterCleanupNeeded);
-  ExpectReporterLaunches(0, 1, true);
+  ExpectReporterLaunches(0, 1, expect_prompt);
   ExpectToRunAgain(kDaysBetweenSuccessfulSwReporterRuns);
 }
 
@@ -642,9 +666,13 @@
   ExpectToRunAgain(kDaysBetweenSuccessfulSwReporterRuns);
 }
 
-INSTANTIATE_TEST_CASE_P(WithInBrowserCleanerUIParam,
-                        ReporterRunnerTest,
-                        testing::Bool());
+INSTANTIATE_TEST_CASE_P(
+    WithInBrowserCleanerUIParam,
+    ReporterRunnerTest,
+    ::testing::Combine(
+        ::testing::Bool(),                          // in_browser_cleaner_ui_
+        ::testing::Values("", "Seed1"),             // old_seed_
+        ::testing::Values("", "Seed1", "Seed2")));  // incoming_seed
 
 // This provide tests which allows explicit invocation of the SRT Prompt
 // useful for checking dialog layout or any other interactive functionality

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc
index 04b9e56d..3059caf 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc

@@ -638,10 +638,6 @@
 void MaybeFetchSRT(Browser* browser, const base::Version& reporter_version) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  if (g_testing_delegate_) {
-    g_testing_delegate_->TriggerPrompt();
-    return;
-  }
   Profile* profile = browser->profile();
   DCHECK(profile);
   PrefService* prefs = profile->GetPrefs();
@@ -670,6 +666,11 @@
   prefs->SetString(prefs::kSwReporterPromptVersion,
                    reporter_version.GetString());
 
+  if (g_testing_delegate_) {
+    g_testing_delegate_->TriggerPrompt();
+    return;
+  }
+
   // Download the SRT.
   RecordReporterStepHistogram(SW_REPORTER_DOWNLOAD_START);
   FetchChromeCleaner(base::Bind(DisplaySRTPrompt));

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.cc
index 40b155a..6e90c848 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.cc

@@ -15,7 +15,6 @@
 namespace {
 
 // Field trial strings.
-const char kSRTPromptTrial[] = "SRTPromptFieldTrial";
 const char kSRTCanaryGroup[] = "SRTCanary";
 const char kSRTPromptOffGroup[] = "Off";
 const char kSRTPromptSeedParam[] = "Seed";
@@ -41,6 +40,8 @@
 
 namespace safe_browsing {
 
+const char kSRTPromptTrial[] = "SRTPromptFieldTrial";
+
 const base::Feature kInBrowserCleanerUIFeature{
     "InBrowserCleanerUI", base::FEATURE_DISABLED_BY_DEFAULT};
 

diff --git a/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h b/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h
index d75cdaea6d..720f6e60 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h
+++ b/chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h

@@ -56,6 +56,8 @@
 // within Chrome.
 extern const base::Feature kInBrowserCleanerUIFeature;
 
+extern const char kSRTPromptTrial[];
+
 // Returns true if this Chrome is in a field trial group which shows the SRT
 // prompt.
 bool IsInSRTPromptFieldTrialGroups();

diff --git a/chrome/browser/safe_browsing/local_database_manager.h b/chrome/browser/safe_browsing/local_database_manager.h
index 72f481f..327ea7e1 100644
--- a/chrome/browser/safe_browsing/local_database_manager.h
+++ b/chrome/browser/safe_browsing/local_database_manager.h

@@ -10,7 +10,6 @@
 
 #include <stddef.h>
 
-#include <deque>
 #include <map>
 #include <memory>
 #include <set>
@@ -18,6 +17,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -376,7 +376,7 @@
   // is true, nothing on the IO thread should access the database.
   bool closing_database_;
 
-  std::deque<QueuedCheck> queued_checks_;
+  base::circular_deque<QueuedCheck> queued_checks_;
 
   // Timeout to use for safe browsing checks.
   base::TimeDelta check_timeout_;

diff --git a/chrome/browser/safe_browsing/protocol_manager.h b/chrome/browser/safe_browsing/protocol_manager.h
index 125d7e25..66fa557 100644
--- a/chrome/browser/safe_browsing/protocol_manager.h
+++ b/chrome/browser/safe_browsing/protocol_manager.h

@@ -16,12 +16,12 @@
 #include <stddef.h>
 
 #include <algorithm>
-#include <deque>
 #include <memory>
 #include <set>
 #include <string>
 #include <vector>
 
+#include "base/containers/circular_deque.h"
 #include "base/containers/hash_tables.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
@@ -332,7 +332,7 @@
   base::OneShotTimer timeout_timer_;
 
   // All chunk requests that need to be made.
-  std::deque<ChunkUrl> chunk_request_urls_;
+  base::circular_deque<ChunkUrl> chunk_request_urls_;
 
   std::map<const net::URLFetcher*,
            std::pair<std::unique_ptr<net::URLFetcher>, FullHashDetails>>

diff --git a/chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h b/chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h
index 9767f57..55b2d85 100644
--- a/chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h
+++ b/chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager.h

@@ -5,7 +5,7 @@
 #ifndef CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_
 #define CHROME_BROWSER_SAFE_BROWSING_SAFE_BROWSING_NAVIGATION_OBSERVER_MANAGER_H_
 
-#include <deque>
+#include "base/containers/circular_deque.h"
 #include "base/feature_list.h"
 #include "base/supports_user_data.h"
 #include "components/safe_browsing/proto/csd.pb.h"
@@ -85,7 +85,7 @@
   }
 
  private:
-  std::deque<std::unique_ptr<NavigationEvent>> navigation_events_;
+  base::circular_deque<std::unique_ptr<NavigationEvent>> navigation_events_;
   const std::size_t size_limit_;
 };
 

diff --git a/chrome/browser/safe_browsing/safe_browsing_store.h b/chrome/browser/safe_browsing/safe_browsing_store.h
index af34890..76b241e3 100644
--- a/chrome/browser/safe_browsing/safe_browsing_store.h
+++ b/chrome/browser/safe_browsing/safe_browsing_store.h

@@ -7,11 +7,11 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <set>
 #include <vector>
 
 #include "base/callback_forward.h"
+#include "base/containers/circular_deque.h"
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "base/time/time.h"
@@ -61,7 +61,7 @@
 
 // TODO(shess): Measure the performance impact of switching this back to
 // std::vector<> once the v8 file format dominates.  Also SBSubPrefixes.
-typedef std::deque<SBAddPrefix> SBAddPrefixes;
+using SBAddPrefixes = base::circular_deque<SBAddPrefix>;
 
 struct SBSubPrefix {
   int32_t chunk_id;
@@ -76,7 +76,7 @@
   SBPrefix GetAddPrefix() const { return add_prefix; }
 };
 
-typedef std::deque<SBSubPrefix> SBSubPrefixes;
+using SBSubPrefixes = base::circular_deque<SBSubPrefix>;
 
 struct SBAddFullHash {
   int32_t chunk_id;

diff --git a/chrome/browser/signin/chrome_signin_helper.cc b/chrome/browser/signin/chrome_signin_helper.cc
index dc66328e..522d45e 100644
--- a/chrome/browser/signin/chrome_signin_helper.cc
+++ b/chrome/browser/signin/chrome_signin_helper.cc

@@ -42,7 +42,6 @@
 const char kChromeManageAccountsHeader[] = "X-Chrome-Manage-Accounts";
 
 #if BUILDFLAG(ENABLE_DICE_SUPPORT)
-const char kDiceResponseHeader[] = "X-Chrome-ID-Consistency-Response";
 const char kGoogleSignoutResponseHeader[] = "Google-Accounts-SignOut";
 #endif
 

diff --git a/chrome/browser/sync/test/integration/migration_test.cc b/chrome/browser/sync/test/integration/migration_test.cc
index b3b81c3..525b34e 100644
--- a/chrome/browser/sync/test/integration/migration_test.cc
+++ b/chrome/browser/sync/test/integration/migration_test.cc

@@ -6,6 +6,7 @@
 #include <vector>
 
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/sync/test/integration/bookmarks_helper.h"
@@ -42,7 +43,7 @@
 
 // An ordered list of model types sets to migrate.  Used by
 // RunMigrationTest().
-using MigrationList = std::deque<syncer::ModelTypeSet>;
+using MigrationList = base::circular_deque<syncer::ModelTypeSet>;
 
 // Utility functions to make a MigrationList out of a small number of
 // model types / model type sets.

diff --git a/chrome/browser/sync_file_system/drive_backend/sync_task_manager_unittest.cc b/chrome/browser/sync_file_system/drive_backend/sync_task_manager_unittest.cc
index 660dcb06..51df964 100644
--- a/chrome/browser/sync_file_system/drive_backend/sync_task_manager_unittest.cc
+++ b/chrome/browser/sync_file_system/drive_backend/sync_task_manager_unittest.cc

@@ -5,11 +5,11 @@
 #include "chrome/browser/sync_file_system/drive_backend/sync_task_manager.h"
 
 #include <stdint.h>
-#include <deque>
 #include <string>
 #include <utility>
 
 #include "base/bind.h"
+#include "base/containers/circular_deque.h"
 #include "base/location.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
@@ -278,7 +278,7 @@
 
   std::string name_;
   std::string app_id_;
-  std::deque<std::string> paths_;
+  base::circular_deque<std::string> paths_;
   Log* log_;
 
   base::WeakPtrFactory<BlockerUpdateTestHelper> weak_ptr_factory_;

diff --git a/chrome/browser/sync_file_system/file_change.h b/chrome/browser/sync_file_system/file_change.h
index d0392ad0..e2a9147 100644
--- a/chrome/browser/sync_file_system/file_change.h
+++ b/chrome/browser/sync_file_system/file_change.h

@@ -7,9 +7,9 @@
 
 #include <stddef.h>
 
-#include <deque>
 #include <string>
 
+#include "base/containers/circular_deque.h"
 #include "base/files/file_path.h"
 #include "chrome/browser/sync_file_system/sync_file_type.h"
 #include "storage/browser/fileapi/file_system_url.h"
@@ -49,7 +49,7 @@
 
 class FileChangeList {
  public:
-  typedef std::deque<FileChange> List;
+  using List = base::circular_deque<FileChange>;
 
   FileChangeList();
   FileChangeList(const FileChangeList& other);

diff --git a/chrome/browser/sync_file_system/local/local_file_change_tracker.cc b/chrome/browser/sync_file_system/local/local_file_change_tracker.cc
index 7a6771b2..4bdb42e 100644
--- a/chrome/browser/sync_file_system/local/local_file_change_tracker.cc
+++ b/chrome/browser/sync_file_system/local/local_file_change_tracker.cc

@@ -8,6 +8,7 @@
 #include <queue>
 #include <utility>
 
+#include "base/containers/circular_deque.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/macros.h"
@@ -137,7 +138,8 @@
 }
 
 void LocalFileChangeTracker::GetNextChangedURLs(
-    std::deque<FileSystemURL>* urls, int max_urls) {
+    base::circular_deque<FileSystemURL>* urls,
+    int max_urls) {
   DCHECK(file_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(urls);
   urls->clear();
@@ -318,7 +320,7 @@
 
 void LocalFileChangeTracker::GetAllChangedURLs(FileSystemURLSet* urls) {
   DCHECK(file_task_runner_->RunsTasksInCurrentSequence());
-  std::deque<FileSystemURL> url_deque;
+  base::circular_deque<FileSystemURL> url_deque;
   GetNextChangedURLs(&url_deque, 0);
   urls->clear();
   urls->insert(url_deque.begin(), url_deque.end());

diff --git a/chrome/browser/sync_file_system/local/local_file_change_tracker.h b/chrome/browser/sync_file_system/local/local_file_change_tracker.h
index 5eeb8a6..8064e19 100644
--- a/chrome/browser/sync_file_system/local/local_file_change_tracker.h
+++ b/chrome/browser/sync_file_system/local/local_file_change_tracker.h

@@ -7,12 +7,12 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <map>
 #include <memory>
 #include <string>
 
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -70,7 +70,7 @@
   // If |max_urls| is non-zero (recommended in production code) this
   // returns URLs up to the number from the ones that have smallest
   // change_seq numbers (i.e. older changes).
-  void GetNextChangedURLs(std::deque<storage::FileSystemURL>* urls,
+  void GetNextChangedURLs(base::circular_deque<storage::FileSystemURL>* urls,
                           int max_urls);
 
   // Returns all changes recorded for the given |url|.

diff --git a/chrome/browser/sync_file_system/local/local_file_change_tracker_unittest.cc b/chrome/browser/sync_file_system/local/local_file_change_tracker_unittest.cc
index 36044a0..90c1a87 100644
--- a/chrome/browser/sync_file_system/local/local_file_change_tracker_unittest.cc
+++ b/chrome/browser/sync_file_system/local/local_file_change_tracker_unittest.cc

@@ -6,10 +6,10 @@
 
 #include <stdint.h>
 
-#include <deque>
 #include <memory>
 #include <set>
 
+#include "base/containers/circular_deque.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
@@ -187,7 +187,7 @@
   EXPECT_FALSE(base::ContainsKey(urls, URL(kPath0)));
 
   // GetNextChangedURLs only returns up to max_urls (i.e. 3) urls.
-  std::deque<FileSystemURL> urls_to_process;
+  base::circular_deque<FileSystemURL> urls_to_process;
   change_tracker()->GetNextChangedURLs(&urls_to_process, 3);
   ASSERT_EQ(3U, urls_to_process.size());
 
@@ -618,7 +618,7 @@
   EXPECT_EQ(base::File::FILE_OK,
             file_system_.Copy(URL(kPath0), URL(kPath0Copy)));
 
-  std::deque<FileSystemURL> urls_to_process;
+  base::circular_deque<FileSystemURL> urls_to_process;
   change_tracker()->GetNextChangedURLs(&urls_to_process, 0);
   ASSERT_EQ(6U, urls_to_process.size());
 

diff --git a/chrome/browser/sync_file_system/local/local_file_sync_context.h b/chrome/browser/sync_file_system/local/local_file_sync_context.h
index 7d72280..7423b41 100644
--- a/chrome/browser/sync_file_system/local/local_file_sync_context.h
+++ b/chrome/browser/sync_file_system/local/local_file_sync_context.h

@@ -5,7 +5,6 @@
 #ifndef CHROME_BROWSER_SYNC_FILE_SYSTEM_LOCAL_LOCAL_FILE_SYNC_CONTEXT_H_
 #define CHROME_BROWSER_SYNC_FILE_SYSTEM_LOCAL_LOCAL_FILE_SYNC_CONTEXT_H_
 
-#include <deque>
 #include <map>
 #include <memory>
 #include <set>
@@ -13,6 +12,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/containers/circular_deque.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
@@ -210,9 +210,9 @@
   void OnWriteEnabled(const storage::FileSystemURL& url) override;
 
  private:
-  typedef base::Callback<void(base::File::Error result)> StatusCallback;
-  typedef std::deque<SyncStatusCallback> StatusCallbackQueue;
-  typedef std::deque<storage::FileSystemURL> FileSystemURLQueue;
+  using StatusCallback = base::Callback<void(base::File::Error result)>;
+  using StatusCallbackQueue = base::circular_deque<SyncStatusCallback>;
+  using FileSystemURLQueue = base::circular_deque<storage::FileSystemURL>;
   friend class base::RefCountedThreadSafe<LocalFileSyncContext>;
   friend class CannedSyncableFileSystem;
 

diff --git a/chrome/browser/sync_file_system/task_logger.h b/chrome/browser/sync_file_system/task_logger.h
index 47bac34f..ca42f49 100644
--- a/chrome/browser/sync_file_system/task_logger.h
+++ b/chrome/browser/sync_file_system/task_logger.h

@@ -5,11 +5,11 @@
 #ifndef CHROME_BROWSER_SYNC_FILE_SYSTEM_TASK_LOGGER_H_
 #define CHROME_BROWSER_SYNC_FILE_SYSTEM_TASK_LOGGER_H_
 
-#include <deque>
 #include <memory>
 #include <string>
 #include <vector>
 
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
@@ -31,7 +31,7 @@
     ~TaskLog();
   };
 
-  using LogList = std::deque<std::unique_ptr<TaskLog>>;
+  using LogList = base::circular_deque<std::unique_ptr<TaskLog>>;
 
   class Observer {
    public:

diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 6c7452a4..b4124b3c 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn

@@ -1220,6 +1220,10 @@
       "webui/chromeos/user_image_source.h",
       "webui/help/help_utils_chromeos.cc",
       "webui/help/help_utils_chromeos.h",
+      "webui/sys_internals/sys_internals_message_handler.cc",
+      "webui/sys_internals/sys_internals_message_handler.h",
+      "webui/sys_internals/sys_internals_ui.cc",
+      "webui/sys_internals/sys_internals_ui.h",
     ]
     deps += [
       "//chrome/browser/chromeos",

diff --git a/chrome/browser/ui/app_list/search/arc/arc_playstore_search_provider.cc b/chrome/browser/ui/app_list/search/arc/arc_playstore_search_provider.cc
index 66c004825..1bee91ba 100644
--- a/chrome/browser/ui/app_list/search/arc/arc_playstore_search_provider.cc
+++ b/chrome/browser/ui/app_list/search/arc/arc_playstore_search_provider.cc

@@ -18,6 +18,9 @@
 
 namespace {
 constexpr int kHistogramBuckets = 13;
+constexpr char kAppListPlayStoreQueryStateHistogram[] =
+    "Apps.AppListPlayStoreQueryState";
+constexpr int kAppListPlayStoreQueryStateNum = 3;
 
 // Skips Play Store apps that have equivalent extensions installed.
 // Do not skip recent instant apps since they should be treated like
@@ -76,6 +79,8 @@
     base::TimeTicks query_start_time,
     arc::mojom::AppDiscoveryRequestState state,
     std::vector<arc::mojom::AppDiscoveryResultPtr> results) {
+  UMA_HISTOGRAM_ENUMERATION(kAppListPlayStoreQueryStateHistogram, state,
+                            kAppListPlayStoreQueryStateNum);
   if (state != arc::mojom::AppDiscoveryRequestState::SUCCESS) {
     DCHECK(results.empty());
     ClearResults();

diff --git a/chrome/browser/ui/ash/chrome_shell_delegate.cc b/chrome/browser/ui/ash/chrome_shell_delegate.cc
index bc6fd95..bc21033 100644
--- a/chrome/browser/ui/ash/chrome_shell_delegate.cc
+++ b/chrome/browser/ui/ash/chrome_shell_delegate.cc

@@ -113,12 +113,6 @@
     ash::Shell::Get()->RemoveShellObserver(AccessibilityManager::Get());
   }
 
-  void ToggleHighContrast() override {
-    DCHECK(AccessibilityManager::Get());
-    AccessibilityManager::Get()->EnableHighContrast(
-        !AccessibilityManager::Get()->IsHighContrastEnabled());
-  }
-
   bool IsSpokenFeedbackEnabled() const override {
     DCHECK(AccessibilityManager::Get());
     return AccessibilityManager::Get()->IsSpokenFeedbackEnabled();
@@ -130,11 +124,6 @@
     AccessibilityManager::Get()->ToggleSpokenFeedback(notify);
   }
 
-  bool IsHighContrastEnabled() const override {
-    DCHECK(AccessibilityManager::Get());
-    return AccessibilityManager::Get()->IsHighContrastEnabled();
-  }
-
   void SetMagnifierEnabled(bool enabled) override {
     DCHECK(chromeos::MagnificationManager::Get());
     return chromeos::MagnificationManager::Get()->SetMagnifierEnabled(enabled);

diff --git a/chrome/browser/ui/ash/palette_delegate_chromeos.cc b/chrome/browser/ui/ash/palette_delegate_chromeos.cc
index 78b4623..b5b596c 100644
--- a/chrome/browser/ui/ash/palette_delegate_chromeos.cc
+++ b/chrome/browser/ui/ash/palette_delegate_chromeos.cc

@@ -34,8 +34,18 @@
     : public ash::HighlighterSelectionObserver {
  public:
   explicit VoiceInteractionSelectionObserver(Profile* profile)
-      : profile_(profile) {}
-  ~VoiceInteractionSelectionObserver() override = default;
+      : profile_(profile) {
+    ash::Shell::Get()->highlighter_controller()->SetObserver(this);
+  }
+
+  ~VoiceInteractionSelectionObserver() override {
+    if (ash::Shell::Get()->highlighter_controller())
+      ash::Shell::Get()->highlighter_controller()->SetObserver(nullptr);
+  };
+
+  void set_on_selection_done(base::OnceClosure done) {
+    on_selection_done_ = std::move(done);
+  }
 
  private:
   void HandleSelection(const gfx::Rect& rect) override {
@@ -48,6 +58,9 @@
                    base::Unretained(this), rect),
         false /* not repeating */);
     delay_timer_->Reset();
+
+    DCHECK(on_selection_done_);
+    std::move(on_selection_done_).Run();
   }
 
   void ReportSelection(const gfx::Rect& rect) {
@@ -62,6 +75,7 @@
   Profile* const profile_;  // Owned by ProfileManager.
 
   std::unique_ptr<base::Timer> delay_timer_;
+  base::OnceClosure on_selection_done_;
 
   DISALLOW_COPY_AND_ASSIGN(VoiceInteractionSelectionObserver);
 };
@@ -74,8 +88,6 @@
 }
 
 PaletteDelegateChromeOS::~PaletteDelegateChromeOS() {
-  if (highlighter_selection_observer_)
-    ash::Shell::Get()->highlighter_controller()->SetObserver(nullptr);
 }
 
 std::unique_ptr<PaletteDelegateChromeOS::EnableListenerSubscription>
@@ -200,7 +212,7 @@
   ash::Shell::Get()->screenshot_controller()->CancelScreenshotSession();
 }
 
-void PaletteDelegateChromeOS::ShowMetalayer() {
+void PaletteDelegateChromeOS::ShowMetalayer(base::OnceClosure done) {
   auto* service =
       arc::ArcVoiceInteractionFrameworkService::GetForBrowserContext(profile_);
   if (!service)
@@ -210,9 +222,8 @@
   if (!highlighter_selection_observer_) {
     highlighter_selection_observer_ =
         base::MakeUnique<VoiceInteractionSelectionObserver>(profile_);
-    ash::Shell::Get()->highlighter_controller()->SetObserver(
-        highlighter_selection_observer_.get());
   }
+  highlighter_selection_observer_->set_on_selection_done(std::move(done));
   ash::Shell::Get()->highlighter_controller()->SetEnabled(true);
 }
 

diff --git a/chrome/browser/ui/ash/palette_delegate_chromeos.h b/chrome/browser/ui/ash/palette_delegate_chromeos.h
index 2790213..beaba44 100644
--- a/chrome/browser/ui/ash/palette_delegate_chromeos.h
+++ b/chrome/browser/ui/ash/palette_delegate_chromeos.h

@@ -19,12 +19,10 @@
 class PrefChangeRegistrar;
 class Profile;
 
-namespace ash {
-class HighlighterSelectionObserver;
-}
-
 namespace chromeos {
 
+class VoiceInteractionSelectionObserver;
+
 // A class which allows the Ash palette to perform chrome actions.
 class PaletteDelegateChromeOS
     : public ash::PaletteDelegate,
@@ -45,7 +43,7 @@
   void TakeScreenshot() override;
   void TakePartialScreenshot(const base::Closure& done) override;
   void CancelPartialScreenshot() override;
-  void ShowMetalayer() override;
+  void ShowMetalayer(base::OnceClosure done) override;
   void HideMetalayer() override;
 
   // user_manager::UserManager::UserSessionStateObserver:
@@ -71,7 +69,7 @@
       session_state_observer_;
   content::NotificationRegistrar registrar_;
 
-  std::unique_ptr<ash::HighlighterSelectionObserver>
+  std::unique_ptr<VoiceInteractionSelectionObserver>
       highlighter_selection_observer_;
 
   base::WeakPtrFactory<PaletteDelegateChromeOS> weak_factory_;

diff --git a/chrome/browser/ui/browser_browsertest.cc b/chrome/browser/ui/browser_browsertest.cc
index 3fd7f39..4d68e2b 100644
--- a/chrome/browser/ui/browser_browsertest.cc
+++ b/chrome/browser/ui/browser_browsertest.cc

@@ -1443,25 +1443,27 @@
   // Write out the pinned tabs.
   PinnedTabCodec::WritePinnedTabs(browser()->profile());
 
-  // Simulate launching again.
+  // Close the browser window.
+  browser()->window()->Close();
+
+  // Launch again with the same profile.
   base::CommandLine dummy(base::CommandLine::NO_PROGRAM);
   chrome::startup::IsFirstRun first_run = first_run::IsChromeFirstRun() ?
       chrome::startup::IS_FIRST_RUN : chrome::startup::IS_NOT_FIRST_RUN;
   StartupBrowserCreatorImpl launch(base::FilePath(), dummy, first_run);
-  launch.profile_ = browser()->profile();
-  launch.ProcessStartupURLs(std::vector<GURL>());
+  launch.Launch(browser()->profile(), std::vector<GURL>(), false);
 
   // The launch should have created a new browser.
   ASSERT_EQ(2u, chrome::GetBrowserCount(browser()->profile()));
 
   // Find the new browser.
-  Browser* new_browser = NULL;
-  for (auto* b : *BrowserList::GetInstance()) {
-    if (b != browser())
-      new_browser = b;
-  }
-  ASSERT_TRUE(new_browser);
-  ASSERT_TRUE(new_browser != browser());
+  BrowserList* browsers = BrowserList::GetInstance();
+  auto new_browser_iter =
+      std::find_if(browsers->begin(), browsers->end(),
+                   [this](Browser* b) { return b != browser(); });
+  ASSERT_NE(browsers->end(), new_browser_iter);
+
+  Browser* new_browser = *new_browser_iter;
 
   // We should get back an additional tab for the app, and another for the
   // default home page.
@@ -1472,9 +1474,6 @@
   EXPECT_TRUE(new_model->IsTabPinned(0));
   EXPECT_TRUE(new_model->IsTabPinned(1));
   EXPECT_FALSE(new_model->IsTabPinned(2));
-
-  EXPECT_EQ(GURL(chrome::kChromeUINewTabURL),
-            new_model->GetWebContentsAt(2)->GetURL());
 }
 #endif  // !defined(OS_CHROMEOS)
 

diff --git a/chrome/browser/ui/certificate_dialogs.cc b/chrome/browser/ui/certificate_dialogs.cc
index b1a458c1..d48cb77 100644
--- a/chrome/browser/ui/certificate_dialogs.cc
+++ b/chrome/browser/ui/certificate_dialogs.cc

@@ -19,6 +19,7 @@
 #include "chrome/common/net/x509_certificate_model_nss.h"
 #include "chrome/grit/generated_resources.h"
 #include "net/base/filename_util.h"
+#include "net/cert/x509_util_nss.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/shell_dialogs/select_file_dialog.h"
 #include "url/gurl.h"
@@ -42,9 +43,9 @@
   return result;
 }
 
-std::string GetBase64String(net::X509Certificate::OSCertHandle cert) {
+std::string GetBase64String(CERTCertificate* cert) {
   std::string der_cert;
-  if (!net::X509Certificate::GetDEREncoded(cert, &der_cert))
+  if (!net::x509_util::GetDEREncoded(cert, &der_cert))
     return std::string();
   std::string base64;
   base::Base64Encode(der_cert, &base64);
@@ -60,8 +61,7 @@
  public:
   Exporter(content::WebContents* web_contents,
            gfx::NativeWindow parent,
-           net::X509Certificate::OSCertHandles::iterator certs_begin,
-           net::X509Certificate::OSCertHandles::iterator certs_end);
+           net::ScopedCERTCertificateList cert_chain);
   ~Exporter() override;
 
   // SelectFileDialog::Listener implemenation.
@@ -74,26 +74,20 @@
   scoped_refptr<ui::SelectFileDialog> select_file_dialog_;
 
   // The certificate hierarchy (leaf cert first).
-  net::X509Certificate::OSCertHandles cert_chain_list_;
+  net::ScopedCERTCertificateList cert_chain_list_;
 };
 
 Exporter::Exporter(content::WebContents* web_contents,
                    gfx::NativeWindow parent,
-                   net::X509Certificate::OSCertHandles::iterator certs_begin,
-                   net::X509Certificate::OSCertHandles::iterator certs_end)
+                   net::ScopedCERTCertificateList cert_chain)
     : select_file_dialog_(ui::SelectFileDialog::Create(
           this,
-          std::make_unique<ChromeSelectFilePolicy>(web_contents))) {
-  DCHECK(certs_begin != certs_end);
-  for (net::X509Certificate::OSCertHandles::iterator i = certs_begin;
-       i != certs_end;
-       ++i) {
-    cert_chain_list_.push_back(net::X509Certificate::DupOSCertHandle(*i));
-  }
-
+          std::make_unique<ChromeSelectFilePolicy>(web_contents))),
+      cert_chain_list_(std::move(cert_chain)) {
   // TODO(mattm): should this default to some directory?
   // Maybe SavePackage::GetSaveDirPreference? (Except that it's private.)
-  std::string cert_title = x509_certificate_model::GetTitle(*certs_begin);
+  std::string cert_title =
+      x509_certificate_model::GetTitle(cert_chain_list_.begin()->get());
   base::FilePath suggested_path =
       net::GenerateFileName(GURL::EmptyGURL(),  // url
                             std::string(),      // content_disposition
@@ -114,10 +108,6 @@
   // away so they don't try and call back to us.
   if (select_file_dialog_.get())
     select_file_dialog_->ListenerDestroyed();
-
-  std::for_each(cert_chain_list_.begin(),
-                cert_chain_list_.end(),
-                &net::X509Certificate::FreeOSCertHandle);
 }
 
 void Exporter::FileSelected(const base::FilePath& path, int index,
@@ -126,10 +116,10 @@
   switch (index) {
     case 2:
       for (size_t i = 0; i < cert_chain_list_.size(); ++i)
-        data += GetBase64String(cert_chain_list_[i]);
+        data += GetBase64String(cert_chain_list_[i].get());
       break;
     case 3:
-      net::X509Certificate::GetDEREncoded(cert_chain_list_[0], &data);
+      net::x509_util::GetDEREncoded(cert_chain_list_[0].get(), &data);
       break;
     case 4:
       data = x509_certificate_model::GetCMSString(cert_chain_list_, 0, 1);
@@ -140,7 +130,7 @@
       break;
     case 1:
     default:
-      data = GetBase64String(cert_chain_list_[0]);
+      data = GetBase64String(cert_chain_list_[0].get());
       break;
   }
 
@@ -194,18 +184,19 @@
 void ShowCertExportDialog(content::WebContents* web_contents,
                           gfx::NativeWindow parent,
                           const scoped_refptr<net::X509Certificate>& cert) {
-  net::X509Certificate::OSCertHandles cert_chain;
-  cert_chain.push_back(cert->os_cert_handle());
-  const net::X509Certificate::OSCertHandles& certs =
-      cert->GetIntermediateCertificates();
-  cert_chain.insert(cert_chain.end(), certs.begin(), certs.end());
-  new Exporter(web_contents, parent, cert_chain.begin(), cert_chain.end());
+  net::ScopedCERTCertificateList cert_chain =
+      net::x509_util::CreateCERTCertificateListFromX509Certificate(cert.get());
+  if (!cert_chain.empty())
+    new Exporter(web_contents, parent, std::move(cert_chain));
 }
 
-void ShowCertExportDialog(
-    content::WebContents* web_contents,
-    gfx::NativeWindow parent,
-    net::X509Certificate::OSCertHandles::iterator certs_begin,
-    net::X509Certificate::OSCertHandles::iterator certs_end) {
-  new Exporter(web_contents, parent, certs_begin, certs_end);
+void ShowCertExportDialog(content::WebContents* web_contents,
+                          gfx::NativeWindow parent,
+                          net::ScopedCERTCertificateList::iterator certs_begin,
+                          net::ScopedCERTCertificateList::iterator certs_end) {
+  DCHECK(certs_begin != certs_end);
+  net::ScopedCERTCertificateList cert_chain;
+  for (auto i = certs_begin; i != certs_end; ++i)
+    cert_chain.push_back(net::x509_util::DupCERTCertificate(i->get()));
+  new Exporter(web_contents, parent, std::move(cert_chain));
 }

diff --git a/chrome/browser/ui/certificate_dialogs.h b/chrome/browser/ui/certificate_dialogs.h
index a4f18561..180cf5b 100644
--- a/chrome/browser/ui/certificate_dialogs.h
+++ b/chrome/browser/ui/certificate_dialogs.h

@@ -5,6 +5,7 @@
 #ifndef CHROME_BROWSER_UI_CERTIFICATE_DIALOGS_H_
 #define CHROME_BROWSER_UI_CERTIFICATE_DIALOGS_H_
 
+#include "net/cert/scoped_nss_types.h"
 #include "net/cert/x509_certificate.h"
 #include "ui/shell_dialogs/select_file_dialog.h"
 
@@ -25,10 +26,9 @@
 
 // Show a dialog to save the first certificate or the whole chain encompassed by
 // the iterators.
-void ShowCertExportDialog(
-    content::WebContents* web_contents,
-    gfx::NativeWindow parent,
-    net::X509Certificate::OSCertHandles::iterator certs_begin,
-    net::X509Certificate::OSCertHandles::iterator certs_end);
+void ShowCertExportDialog(content::WebContents* web_contents,
+                          gfx::NativeWindow parent,
+                          net::ScopedCERTCertificateList::iterator certs_begin,
+                          net::ScopedCERTCertificateList::iterator certs_end);
 
 #endif  // CHROME_BROWSER_UI_CERTIFICATE_DIALOGS_H_

diff --git a/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.h b/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.h
index 0e78170..d9662aa 100644
--- a/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.h
+++ b/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.h

@@ -33,7 +33,8 @@
   // Overridden from WebContentsViewDelegate:
   gfx::NativeWindow GetNativeWindow() override;
   NSObject<RenderWidgetHostViewMacDelegate>* CreateRenderWidgetHostViewDelegate(
-      content::RenderWidgetHost* render_widget_host) override;
+      content::RenderWidgetHost* render_widget_host,
+      bool is_popup) override;
   content::WebDragDestDelegate* GetDragDestDelegate() override;
   void ShowContextMenu(content::RenderFrameHost* render_frame_host,
                        const content::ContextMenuParams& params) override;

diff --git a/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm b/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm
index 2ca0f76..4d77258 100644
--- a/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm
+++ b/chrome/browser/ui/cocoa/tab_contents/chrome_web_contents_view_delegate_mac.mm

@@ -35,7 +35,12 @@
 
 NSObject<RenderWidgetHostViewMacDelegate>*
 ChromeWebContentsViewDelegateMac::CreateRenderWidgetHostViewDelegate(
-    content::RenderWidgetHost* render_widget_host) {
+    content::RenderWidgetHost* render_widget_host,
+    bool is_popup) {
+  // We don't need a delegate for popups since they don't have
+  // overscroll.
+  if (is_popup)
+    return nil;
   return [[ChromeRenderWidgetHostViewMacDelegate alloc]
       initWithRenderWidgetHost:render_widget_host];
 }

diff --git a/chrome/browser/ui/crypto_module_password_dialog_nss.cc b/chrome/browser/ui/crypto_module_password_dialog_nss.cc
index d2438f8..d5dc6bd 100644
--- a/chrome/browser/ui/crypto_module_password_dialog_nss.cc
+++ b/chrome/browser/ui/crypto_module_password_dialog_nss.cc

@@ -10,7 +10,6 @@
 #include "base/bind.h"
 #include "base/logging.h"
 #include "content/public/browser/browser_thread.h"
-#include "net/cert/x509_certificate.h"
 
 using content::BrowserThread;
 
@@ -134,14 +133,13 @@
   callback.Run();
 }
 
-void UnlockCertSlotIfNecessary(net::X509Certificate* cert,
+void UnlockCertSlotIfNecessary(CERTCertificate* cert,
                                chrome::CryptoModulePasswordReason reason,
                                const net::HostPortPair& server,
                                gfx::NativeWindow parent,
                                const base::Closure& callback) {
   std::vector<crypto::ScopedPK11Slot> modules;
-  modules.push_back(
-      crypto::ScopedPK11Slot(PK11_ReferenceSlot(cert->os_cert_handle()->slot)));
+  modules.push_back(crypto::ScopedPK11Slot(PK11_ReferenceSlot(cert->slot)));
   UnlockSlotsIfNecessary(std::move(modules), reason, server, parent, callback);
 }
 

diff --git a/chrome/browser/ui/crypto_module_password_dialog_nss.h b/chrome/browser/ui/crypto_module_password_dialog_nss.h
index 9fb2d8ed..c9111d7 100644
--- a/chrome/browser/ui/crypto_module_password_dialog_nss.h
+++ b/chrome/browser/ui/crypto_module_password_dialog_nss.h

@@ -15,9 +15,7 @@
 #include "net/base/host_port_pair.h"
 #include "ui/gfx/native_widget_types.h"
 
-namespace net {
-class X509Certificate;
-}
+typedef struct CERTCertificateStr CERTCertificate;
 
 namespace chrome {
 
@@ -33,7 +31,7 @@
 // Asynchronously unlock the |cert|'s module, if necessary. |callback| is
 // called when done (regardless if module was successfully unlocked or not).
 // Should only be called on UI thread.
-void UnlockCertSlotIfNecessary(net::X509Certificate* cert,
+void UnlockCertSlotIfNecessary(CERTCertificate* cert,
                                CryptoModulePasswordReason reason,
                                const net::HostPortPair& server,
                                gfx::NativeWindow parent,

diff --git a/chrome/browser/ui/startup/startup_browser_creator.cc b/chrome/browser/ui/startup/startup_browser_creator.cc
index 46f54ee..e0d3953 100644
--- a/chrome/browser/ui/startup/startup_browser_creator.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator.cc

@@ -6,18 +6,15 @@
 
 #include <stddef.h>
 
-#include <algorithm>  // For max().
 #include <limits>
-#include <memory>
 #include <set>
+#include <string>
 
 #include "apps/switches.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
-#include "base/compiler_specific.h"
 #include "base/debug/alias.h"
-#include "base/environment.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/lazy_instance.h"
@@ -25,12 +22,8 @@
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/statistics_recorder.h"
-#include "base/metrics/user_metrics_action.h"
-#include "base/strings/string_number_conversions.h"
-#include "base/strings/string_split.h"
+#include "base/strings/string16.h"
 #include "base/strings/string_tokenizer.h"
-#include "base/strings/string_util.h"
-#include "base/strings/utf_string_conversions.h"
 #include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/trace_event/trace_event.h"
@@ -39,9 +32,7 @@
 #include "chrome/browser/apps/app_load_service.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
-#include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/extensions/startup_helper.h"
-#include "chrome/browser/extensions/unpacked_installer.h"
 #include "chrome/browser/first_run/first_run.h"
 #include "chrome/browser/net/predictor.h"
 #include "chrome/browser/prefs/incognito_mode_prefs.h"
@@ -50,24 +41,17 @@
 #include "chrome/browser/profiles/profile_attributes_entry.h"
 #include "chrome/browser/profiles/profile_attributes_storage.h"
 #include "chrome/browser/profiles/profile_manager.h"
-#include "chrome/browser/profiles/profiles_state.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "chrome/browser/ui/browser.h"
-#include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/startup/startup_browser_creator_impl.h"
-#include "chrome/browser/ui/startup/startup_features.h"
 #include "chrome/browser/ui/user_manager.h"
-#include "chrome/browser/ui/webui/settings/reset_settings_handler.h"
 #include "chrome/common/chrome_constants.h"
-#include "chrome/common/chrome_paths.h"
-#include "chrome/common/chrome_result_codes.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/features.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
-#include "components/google/core/browser/google_util.h"
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
 #include "components/search_engines/util.h"
@@ -75,6 +59,10 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/navigation_controller.h"
+#include "content/public/browser/notification_observer.h"
+#include "content/public/browser/notification_registrar.h"
+#include "content/public/browser/notification_service.h"
+#include "content/public/browser/notification_source.h"
 #include "content/public/common/content_switches.h"
 #include "extensions/common/switches.h"
 #include "net/base/port_util.h"
@@ -103,13 +91,11 @@
 #endif
 
 #if defined(OS_WIN)
-#include "base/win/windows_version.h"
 #include "chrome/browser/metrics/jumplist_metrics_win.h"
+#include "chrome/browser/ui/webui/settings/reset_settings_handler.h"
 #endif
 
 #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
-#include "chrome/browser/printing/cloud_print/cloud_print_proxy_service.h"
-#include "chrome/browser/printing/cloud_print/cloud_print_proxy_service_factory.h"
 #include "chrome/browser/printing/print_dialog_cloud.h"
 #endif
 
@@ -493,15 +479,6 @@
 }
 
 // static
-bool StartupBrowserCreator::UseConsolidatedFlow() {
-#if defined(OS_WIN)
-  if (base::win::GetVersion() >= base::win::VERSION_WIN10)
-    return base::FeatureList::IsEnabled(features::kEnableWelcomeWin10);
-#endif  // defined(OS_WIN)
-  return base::FeatureList::IsEnabled(features::kUseConsolidatedStartupFlow);
-}
-
-// static
 std::vector<GURL> StartupBrowserCreator::GetURLsFromCommandLine(
     const base::CommandLine& command_line,
     const base::FilePath& cur_dir,

diff --git a/chrome/browser/ui/startup/startup_browser_creator.h b/chrome/browser/ui/startup/startup_browser_creator.h
index 15f2379..2e9c51e6 100644
--- a/chrome/browser/ui/startup/startup_browser_creator.h
+++ b/chrome/browser/ui/startup/startup_browser_creator.h

@@ -5,18 +5,14 @@
 #ifndef CHROME_BROWSER_UI_STARTUP_STARTUP_BROWSER_CREATOR_H_
 #define CHROME_BROWSER_UI_STARTUP_STARTUP_BROWSER_CREATOR_H_
 
-#include <string>
 #include <vector>
 
 #include "base/files/file_path.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
-#include "build/build_config.h"
 #include "chrome/browser/prefs/session_startup_pref.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/ui/startup/startup_tab.h"
 #include "chrome/browser/ui/startup/startup_types.h"
-#include "url/gurl.h"
 
 class Browser;
 class GURL;
@@ -129,11 +125,6 @@
   static void RegisterLocalStatePrefs(PrefRegistrySimple* registry);
   static void RegisterProfilePrefs(PrefRegistrySimple* registry);
 
-  // Returns whether the Consolidated startup flow will be used, based on the
-  // platform-appropriate Feature.
-  // TODO(tmartino): Remove once this is on 100%.
-  static bool UseConsolidatedFlow();
-
  private:
   friend class CloudPrintProxyPolicyTest;
   friend class CloudPrintProxyPolicyStartupTest;

diff --git a/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc b/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc
index 4064952a..c96dd6a4 100644
--- a/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator_browsertest.cc

@@ -39,6 +39,7 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/startup/startup_browser_creator.h"
 #include "chrome/browser/ui/startup/startup_browser_creator_impl.h"
+#include "chrome/browser/ui/startup/startup_tab_provider.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension_constants.h"

diff --git a/chrome/browser/ui/startup/startup_browser_creator_impl.cc b/chrome/browser/ui/startup/startup_browser_creator_impl.cc
index c482d2c..549a8f1 100644
--- a/chrome/browser/ui/startup/startup_browser_creator_impl.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator_impl.cc

@@ -5,64 +5,39 @@
 #include "chrome/browser/ui/startup/startup_browser_creator_impl.h"
 
 #include <stddef.h>
-#include <stdint.h>
 
 #include <algorithm>
 #include <iterator>
 #include <memory>
 #include <vector>
 
-#include "apps/app_restore_service.h"
-#include "apps/app_restore_service_factory.h"
 #include "base/auto_reset.h"
-#include "base/bind.h"
-#include "base/bind_helpers.h"
 #include "base/command_line.h"
-#include "base/compiler_specific.h"
 #include "base/environment.h"
-#include "base/feature_list.h"
-#include "base/lazy_instance.h"
 #include "base/metrics/histogram_macros.h"
-#include "base/metrics/statistics_recorder.h"
-#include "base/strings/string_number_conversions.h"
-#include "base/strings/string_split.h"
-#include "base/strings/string_util.h"
-#include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
 #include "chrome/browser/apps/install_chrome_app.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
 #include "chrome/browser/defaults.h"
-#include "chrome/browser/extensions/extension_creator.h"
 #include "chrome/browser/extensions/extension_util.h"
 #include "chrome/browser/extensions/launch_util.h"
-#include "chrome/browser/extensions/pack_extension_job.h"
-#include "chrome/browser/first_run/first_run.h"
 #include "chrome/browser/infobars/infobar_service.h"
-#include "chrome/browser/prefs/incognito_mode_prefs.h"
 #include "chrome/browser/prefs/session_startup_pref.h"
-#include "chrome/browser/profile_resetter/triggered_profile_resetter.h"
-#include "chrome/browser/profile_resetter/triggered_profile_resetter_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_io_data.h"
 #include "chrome/browser/sessions/session_service.h"
 #include "chrome/browser/sessions/session_service_factory.h"
-#include "chrome/browser/shell_integration.h"
-#include "chrome/browser/signin/signin_promo.h"
 #include "chrome/browser/ui/app_list/app_list_service.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_navigator.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
-#include "chrome/browser/ui/browser_tabrestore.h"
 #include "chrome/browser/ui/browser_tabstrip.h"
 #include "chrome/browser/ui/browser_window.h"
-#include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/extensions/app_launch_params.h"
 #include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/ui/session_crashed_bubble.h"
@@ -72,36 +47,24 @@
 #include "chrome/browser/ui/startup/google_api_keys_infobar_delegate.h"
 #include "chrome/browser/ui/startup/obsolete_system_infobar_delegate.h"
 #include "chrome/browser/ui/startup/startup_browser_creator.h"
-#include "chrome/browser/ui/tabs/pinned_tab_codec.h"
+#include "chrome/browser/ui/startup/startup_tab_provider.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
-#include "chrome/common/chrome_constants.h"
-#include "chrome/common/chrome_paths.h"
-#include "chrome/common/chrome_result_codes.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/extensions/extension_metrics.h"
-#include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
-#include "chrome/grit/locale_settings.h"
-#include "components/google/core/browser/google_util.h"
-#include "components/prefs/pref_service.h"
 #include "components/rappor/public/rappor_utils.h"
 #include "components/rappor/rappor_service_impl.h"
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/dom_storage_context.h"
-#include "content/public/browser/notification_observer.h"
-#include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_set.h"
-#include "net/base/network_change_notifier.h"
 #include "rlz/features/features.h"
-#include "ui/base/l10n/l10n_util.h"
 #include "ui/base/ui_features.h"
 
 #if defined(OS_MACOSX)
@@ -121,6 +84,7 @@
 #endif
 
 #if BUILDFLAG(ENABLE_RLZ)
+#include "components/google/core/browser/google_util.h"
 #include "components/rlz/rlz_tracker.h"  // nogncheck
 #endif
 
@@ -241,29 +205,6 @@
                                   app_type);
 }
 
-void RecordAppLaunches(Profile* profile,
-                       const std::vector<GURL>& cmd_line_urls,
-                       const StartupTabs& autolaunch_tabs) {
-  const extensions::ExtensionSet& extensions =
-      extensions::ExtensionRegistry::Get(profile)->enabled_extensions();
-  for (size_t i = 0; i < cmd_line_urls.size(); ++i) {
-    const extensions::Extension* extension =
-        extensions.GetAppByURL(cmd_line_urls.at(i));
-    if (extension) {
-      extensions::RecordAppLaunchType(extension_misc::APP_LAUNCH_CMD_LINE_URL,
-                                      extension->GetType());
-    }
-  }
-  for (size_t i = 0; i < autolaunch_tabs.size(); ++i) {
-    const extensions::Extension* extension =
-        extensions.GetAppByURL(autolaunch_tabs.at(i).url);
-    if (extension) {
-      extensions::RecordAppLaunchType(extension_misc::APP_LAUNCH_AUTOLAUNCH,
-                                      extension->GetType());
-    }
-  }
-}
-
 // TODO(koz): Consolidate this function and remove the special casing.
 const Extension* GetPlatformApp(Profile* profile,
                                 const std::string& extension_id) {
@@ -281,21 +222,6 @@
 
 }  // namespace
 
-namespace internals {
-
-GURL GetTriggeredResetSettingsURL() {
-  return GURL(
-      chrome::GetSettingsUrl(chrome::kTriggeredResetProfileSettingsSubPage));
-}
-
-GURL GetWelcomePageURL() {
-  // Record that the Welcome page was added to the startup url list.
-  UMA_HISTOGRAM_BOOLEAN("Welcome.Win10.OriginalPromoPageAdded", true);
-  return GURL(l10n_util::GetStringUTF8(IDS_WELCOME_PAGE_URL));
-}
-
-}  // namespace internals
-
 StartupBrowserCreatorImpl::StartupBrowserCreatorImpl(
     const base::FilePath& cur_dir,
     const base::CommandLine& command_line,
@@ -304,9 +230,7 @@
       command_line_(command_line),
       profile_(NULL),
       browser_creator_(NULL),
-      is_first_run_(is_first_run == chrome::startup::IS_FIRST_RUN),
-      welcome_run_type_(WelcomeRunType::NONE) {
-}
+      is_first_run_(is_first_run == chrome::startup::IS_FIRST_RUN) {}
 
 StartupBrowserCreatorImpl::StartupBrowserCreatorImpl(
     const base::FilePath& cur_dir,
@@ -317,9 +241,7 @@
       command_line_(command_line),
       profile_(NULL),
       browser_creator_(browser_creator),
-      is_first_run_(is_first_run == chrome::startup::IS_FIRST_RUN),
-      welcome_run_type_(WelcomeRunType::NONE) {
-}
+      is_first_run_(is_first_run == chrome::startup::IS_FIRST_RUN) {}
 
 StartupBrowserCreatorImpl::~StartupBrowserCreatorImpl() {
 }
@@ -373,10 +295,7 @@
                                                      : LM_WITH_URLS);
     }
 
-    if (StartupBrowserCreator::UseConsolidatedFlow())
-      ProcessLaunchUrlsUsingConsolidatedFlow(process_startup, urls_to_open);
-    else
-      ProcessLaunchURLs(process_startup, urls_to_open);
+    DetermineURLsAndLaunch(process_startup, urls_to_open);
 
     if (command_line_.HasSwitch(switches::kInstallChromeApp)) {
       install_chrome_app::InstallChromeApp(
@@ -612,7 +531,7 @@
   return (app_tab != NULL);
 }
 
-void StartupBrowserCreatorImpl::ProcessLaunchUrlsUsingConsolidatedFlow(
+void StartupBrowserCreatorImpl::DetermineURLsAndLaunch(
     bool process_startup,
     const std::vector<GURL>& cmd_line_urls) {
   // Don't open any browser windows if starting up in "background mode".
@@ -789,26 +708,6 @@
   return browser;
 }
 
-void StartupBrowserCreatorImpl::AddUniqueURLs(const std::vector<GURL>& urls,
-                                              StartupTabs* tabs) {
-  size_t num_existing_tabs = tabs->size();
-  for (size_t i = 0; i < urls.size(); ++i) {
-    bool in_tabs = false;
-    for (size_t j = 0; j < num_existing_tabs; ++j) {
-      if (urls[i] == (*tabs)[j].url) {
-        in_tabs = true;
-        break;
-      }
-    }
-    if (!in_tabs) {
-      StartupTab tab;
-      tab.is_pinned = false;
-      tab.url = urls[i];
-      tabs->push_back(tab);
-    }
-  }
-}
-
 void StartupBrowserCreatorImpl::AddInfoBarsIfNecessary(
     Browser* browser,
     chrome::startup::IsProcessStartup is_process_startup) {
@@ -905,363 +804,3 @@
 
   return options;
 }
-
-void StartupBrowserCreatorImpl::ProcessLaunchURLs(
-    bool process_startup,
-    const std::vector<GURL>& urls_to_open) {
-  // Don't open any browser windows if we're starting up in "background mode".
-  if (process_startup && command_line_.HasSwitch(switches::kNoStartupWindow))
-    return;
-
-  // Determine whether or not this launch must include the welcome page.
-  InitializeWelcomeRunType(urls_to_open);
-
-  if (process_startup && ProcessStartupURLs(urls_to_open)) {
-    // ProcessStartupURLs processed the urls, nothing else to do.
-    return;
-  }
-
-  chrome::startup::IsProcessStartup is_process_startup = process_startup ?
-      chrome::startup::IS_PROCESS_STARTUP :
-      chrome::startup::IS_NOT_PROCESS_STARTUP;
-  if (!process_startup) {
-    // Even if we're not starting a new process, this may conceptually be
-    // "startup" for the user and so should be handled in a similar way.  Eg.,
-    // Chrome may have been running in the background due to an app with a
-    // background page being installed, or running with only an app window
-    // displayed.
-    SessionService* service =
-        SessionServiceFactory::GetForProfileForSessionRestore(profile_);
-    if (service && service->ShouldNewWindowStartSession()) {
-      // Restore the last session if any, optionally including the welcome page
-      // if desired.
-      if (!HasPendingUncleanExit(profile_)) {
-        std::vector<GURL> adjusted_urls(urls_to_open);
-        AddSpecialURLs(&adjusted_urls);
-        if (service->RestoreIfNecessary(adjusted_urls))
-          return;
-      }
-
-      // Open user-specified URLs like pinned tabs and startup tabs.
-      Browser* browser = ProcessSpecifiedURLs(urls_to_open);
-      if (browser) {
-        AddInfoBarsIfNecessary(browser, is_process_startup);
-        return;
-      }
-    }
-  }
-
-  // Session startup didn't occur, open the urls.
-  Browser* browser = NULL;
-  std::vector<GURL> adjusted_urls = urls_to_open;
-  if (adjusted_urls.empty()) {
-    AddStartupURLs(&adjusted_urls);
-  } else if (!command_line_.HasSwitch(switches::kOpenInNewWindow)) {
-    // Always open a list of urls in a window on the native desktop.
-    browser = chrome::FindTabbedBrowser(profile_, false);
-  }
-  // This will launch a browser; prevent session restore.
-  StartupBrowserCreator::in_synchronous_profile_launch_ = true;
-  browser = OpenURLsInBrowser(browser, process_startup, adjusted_urls);
-  StartupBrowserCreator::in_synchronous_profile_launch_ = false;
-  AddInfoBarsIfNecessary(browser, is_process_startup);
-}
-
-bool StartupBrowserCreatorImpl::ProcessStartupURLs(
-    const std::vector<GURL>& urls_to_open) {
-  VLOG(1) << "StartupBrowserCreatorImpl::ProcessStartupURLs";
-  SessionStartupPref pref =
-      StartupBrowserCreator::GetSessionStartupPref(command_line_, profile_);
-  if (pref.type == SessionStartupPref::LAST)
-    VLOG(1) << "Pref: last";
-  else if (pref.type == SessionStartupPref::URLS)
-    VLOG(1) << "Pref: urls";
-  else if (pref.type == SessionStartupPref::DEFAULT)
-    VLOG(1) << "Pref: default";
-
-  apps::AppRestoreService* restore_service =
-      apps::AppRestoreServiceFactory::GetForBrowserContext(profile_);
-  // NULL in incognito mode.
-  if (restore_service) {
-    restore_service->HandleStartup(apps::AppRestoreService::ShouldRestoreApps(
-        StartupBrowserCreator::WasRestarted()));
-  }
-
-  // Only activate the session restore logic if it is not the first run. It
-  // makes really no sense to "restore" missing session.
-  if (pref.type == SessionStartupPref::LAST && !is_first_run_) {
-    if (profile_->GetLastSessionExitType() == Profile::EXIT_CRASHED &&
-        !command_line_.HasSwitch(switches::kRestoreLastSession)) {
-      // The last session crashed. It's possible automatically loading the
-      // page will trigger another crash, locking the user out of chrome.
-      // To avoid this, don't restore on startup but instead show the crashed
-      // infobar.
-      VLOG(1) << "Unclean exit; not processing";
-      return false;
-    }
-
-    SessionRestore::BehaviorBitmask restore_behavior =
-        SessionRestore::SYNCHRONOUS;
-    if (browser_defaults::kAlwaysCreateTabbedBrowserOnSessionRestore ||
-        base::CommandLine::ForCurrentProcess()->HasSwitch(
-            switches::kCreateBrowserOnStartupForTests)) {
-      restore_behavior |= SessionRestore::ALWAYS_CREATE_TABBED_BROWSER;
-    }
-
-#if defined(OS_MACOSX)
-    // On Mac, when restoring a session with no windows, suppress the creation
-    // of a new window in the case where the system is launching Chrome via a
-    // login item or Lion's resume feature.
-    if (base::mac::WasLaunchedAsLoginOrResumeItem()) {
-      restore_behavior = restore_behavior &
-                         ~SessionRestore::ALWAYS_CREATE_TABBED_BROWSER;
-    }
-#endif
-
-    std::vector<GURL> adjusted_urls(urls_to_open);
-    AddSpecialURLs(&adjusted_urls);
-
-    // The startup code only executes for browsers launched in desktop mode. Ash
-    // should never get here.
-    Browser* browser = SessionRestore::RestoreSession(
-        profile_, NULL, restore_behavior, adjusted_urls);
-
-    AddInfoBarsIfNecessary(browser, chrome::startup::IS_PROCESS_STARTUP);
-    return true;
-  }
-
-  Browser* browser = ProcessSpecifiedURLs(urls_to_open);
-  if (!browser)
-    return false;
-
-  AddInfoBarsIfNecessary(browser, chrome::startup::IS_PROCESS_STARTUP);
-
-  // Session restore may occur if the startup preference is "last" or if the
-  // crash infobar is displayed. Otherwise, it's safe for the DOM storage system
-  // to start deleting leftover data.
-  if (pref.type != SessionStartupPref::LAST &&
-      !HasPendingUncleanExit(profile_)) {
-    content::BrowserContext::GetDefaultStoragePartition(profile_)->
-        GetDOMStorageContext()->StartScavengingUnusedSessionStorage();
-  }
-
-  return true;
-}
-
-Browser* StartupBrowserCreatorImpl::ProcessSpecifiedURLs(
-    const std::vector<GURL>& urls_to_open) {
-  SessionStartupPref pref =
-      StartupBrowserCreator::GetSessionStartupPref(command_line_, profile_);
-  StartupTabs tabs;
-  // Pinned tabs should not be displayed when chrome is launched in incognito
-  // mode. Also, no pages should be opened automatically if the session
-  // crashed. Otherwise it might trigger another crash, locking the user out of
-  // chrome. The crash infobar is shown in this case.
-  if (!IncognitoModePrefs::ShouldLaunchIncognito(command_line_,
-                                                 profile_->GetPrefs()) &&
-      !HasPendingUncleanExit(profile_)) {
-    tabs = PinnedTabCodec::ReadPinnedTabs(profile_);
-  }
-
-  RecordAppLaunches(profile_, urls_to_open, tabs);
-
-  if (!urls_to_open.empty()) {
-    // If urls were specified on the command line, use them.
-    UrlsToTabs(urls_to_open, &tabs);
-  } else if (pref.type == SessionStartupPref::DEFAULT ||
-             (is_first_run_ &&
-              browser_creator_ && !browser_creator_->first_run_tabs_.empty())) {
-    std::vector<GURL> urls;
-    AddStartupURLs(&urls);
-    UrlsToTabs(urls, &tabs);
-  } else if (pref.type == SessionStartupPref::URLS && !pref.urls.empty() &&
-             !HasPendingUncleanExit(profile_)) {
-    std::vector<GURL> extra_urls;
-    AddSpecialURLs(&extra_urls);
-    UrlsToTabs(extra_urls, &tabs);
-
-    // Only use the set of urls specified in preferences if nothing was
-    // specified on the command line. Filter out any urls that are to be
-    // restored by virtue of having been previously pinned.
-    AddUniqueURLs(pref.urls, &tabs);
-  }
-
-  if (tabs.empty())
-    return NULL;
-
-  Browser* browser = OpenTabsInBrowser(NULL, true, tabs);
-  return browser;
-}
-
-void StartupBrowserCreatorImpl::AddStartupURLs(
-    std::vector<GURL>* startup_urls) const {
-  // If we have urls specified by the first run master preferences use them
-  // and nothing else.
-  if (browser_creator_ && startup_urls->empty()) {
-    if (!browser_creator_->first_run_tabs_.empty()) {
-      std::vector<GURL>::iterator it =
-          browser_creator_->first_run_tabs_.begin();
-      while (it != browser_creator_->first_run_tabs_.end()) {
-        // Replace magic names for the actual urls.
-        if (it->host() == "new_tab_page") {
-          startup_urls->push_back(GURL(chrome::kChromeUINewTabURL));
-        } else if (it->host() == "welcome_page") {
-          startup_urls->push_back(internals::GetWelcomePageURL());
-        } else {
-          startup_urls->push_back(*it);
-        }
-        ++it;
-      }
-      browser_creator_->first_run_tabs_.clear();
-    }
-  }
-
-  // Otherwise open at least the new tab page (and any pages deemed needed by
-  // AddSpecialURLs()), or the set of URLs specified on the command line.
-  if (startup_urls->empty()) {
-    AddSpecialURLs(startup_urls);
-    startup_urls->push_back(GURL(chrome::kChromeUINewTabURL));
-
-    // Special case the FIRST_RUN_LAST_TAB case of the welcome page.
-    if (welcome_run_type_ == WelcomeRunType::FIRST_RUN_LAST_TAB)
-      startup_urls->push_back(internals::GetWelcomePageURL());
-  }
-
-  if (signin::ShouldShowPromoAtStartup(profile_, is_first_run_)) {
-    signin::DidShowPromoAtStartup(profile_);
-
-    const GURL sync_promo_url = signin::GetPromoURL(
-        signin_metrics::AccessPoint::ACCESS_POINT_START_PAGE,
-        signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT, false);
-
-    // No need to add if the sync promo is already in the startup list.
-    bool add_promo = true;
-    for (std::vector<GURL>::const_iterator it = startup_urls->begin();
-         it != startup_urls->end(); ++it) {
-      if (*it == sync_promo_url) {
-        add_promo = false;
-        break;
-      }
-    }
-
-    if (add_promo) {
-      // If the first URL is the NTP, replace it with the sync promo. This
-      // behavior is desired because completing or skipping the sync promo
-      // causes a redirect to the NTP.
-      if (!startup_urls->empty() &&
-          startup_urls->at(0) == chrome::kChromeUINewTabURL) {
-        startup_urls->at(0) = sync_promo_url;
-      } else {
-        startup_urls->insert(startup_urls->begin(), sync_promo_url);
-      }
-    }
-  }
-}
-
-void StartupBrowserCreatorImpl::AddSpecialURLs(
-    std::vector<GURL>* url_list) const {
-  // Optionally include the welcome page.
-  if (welcome_run_type_ == WelcomeRunType::FIRST_TAB)
-    url_list->insert(url_list->begin(), internals::GetWelcomePageURL());
-
-  // If this Profile is marked for a reset prompt, ensure the reset
-  // settings dialog appears.
-  if (ProfileHasResetTrigger()) {
-    url_list->insert(url_list->begin(),
-                     internals::GetTriggeredResetSettingsURL());
-  }
-}
-
-// For first-run, the type will be FIRST_RUN_LAST for all systems except for
-// Windows 10+, where it will be FIRST_RUN_FIRST. For non-first run, the type
-// will be NONE for all systems except for Windows 10+, where it will be
-// ANY_RUN_FIRST if this is the first somewhat normal launch since an OS
-// upgrade.
-void StartupBrowserCreatorImpl::InitializeWelcomeRunType(
-    const std::vector<GURL>& urls_to_open) {
-  DCHECK_EQ(static_cast<int>(WelcomeRunType::NONE),
-            static_cast<int>(welcome_run_type_));
-#if defined(OS_WIN)
-  // Do not welcome if there are any URLs to open.
-  if (!urls_to_open.empty())
-    return;
-
-  base::win::OSInfo* const os_info = base::win::OSInfo::GetInstance();
-  const base::win::OSInfo::VersionNumber v(os_info->version_number());
-  const std::string this_version(base::StringPrintf("%d.%d", v.major, v.minor));
-  PrefService* const local_state = g_browser_process->local_state();
-
-  // Always welcome on first run.
-  if (first_run::ShouldShowWelcomePage()) {
-    // First tab for Win10+, last tab otherwise.
-    welcome_run_type_ = os_info->version() >= base::win::VERSION_WIN10
-                            ? WelcomeRunType::FIRST_TAB
-                            : WelcomeRunType::FIRST_RUN_LAST_TAB;
-  } else {
-    // Otherwise, do not welcome pre-Win10.
-    if (base::win::GetVersion() < base::win::VERSION_WIN10)
-      return;
-
-    // Do not welcome if launching into incognito.
-    if (IncognitoModePrefs::ShouldLaunchIncognito(command_line_,
-                                                  profile_->GetPrefs())) {
-      return;
-    }
-
-    // Do not welcome if there is no local state or profile (tests).
-    if (!local_state || !profile_)
-      return;
-
-    // Do not welcome if disabled by policy or master_preferences.
-    if (!local_state->GetBoolean(prefs::kWelcomePageOnOSUpgradeEnabled))
-      return;
-
-    // Do not welcome if already shown for this OS version.
-    if (local_state->GetString(prefs::kLastWelcomedOSVersion) == this_version)
-      return;
-
-    // Do not welcome if this user has seen chrome://welcome-win10 or
-    // chrome://welcome, which are intended to replace this page.
-    if (local_state->GetBoolean(prefs::kHasSeenWin10PromoPage) ||
-        profile_->GetPrefs()->GetBoolean(prefs::kHasSeenWelcomePage)) {
-      return;
-    }
-
-    // Do not welcome if offline.
-    if (net::NetworkChangeNotifier::IsOffline())
-      return;
-
-    // Do not welcome if this Chrome or another side-by-side install was the
-    // default browser at startup.
-    const shell_integration::DefaultWebClientState web_client_state =
-        g_browser_process->CachedDefaultWebClientState();
-    if (web_client_state == shell_integration::IS_DEFAULT ||
-        web_client_state == shell_integration::OTHER_MODE_IS_DEFAULT) {
-      return;
-    }
-
-    // Show the welcome page in the first tab.
-    welcome_run_type_ = WelcomeRunType::FIRST_TAB;
-  }
-
-  // Remember that the welcome page was shown for this OS version.
-  local_state->SetString(prefs::kLastWelcomedOSVersion, this_version);
-#else  // OS_WIN
-  // Show the welcome page as the last tab only on first-run.
-  if (first_run::ShouldShowWelcomePage())
-    welcome_run_type_ = WelcomeRunType::FIRST_RUN_LAST_TAB;
-#endif  // !OS_WIN
-}
-
-bool StartupBrowserCreatorImpl::ProfileHasResetTrigger() const {
-  bool has_reset_trigger = false;
-#if defined(OS_WIN)
-  TriggeredProfileResetter* triggered_profile_resetter =
-      TriggeredProfileResetterFactory::GetForBrowserContext(profile_);
-  // TriggeredProfileResetter instance will be nullptr for incognito profiles.
-  if (triggered_profile_resetter) {
-    has_reset_trigger = triggered_profile_resetter->HasResetTrigger();
-  }
-#endif  // defined(OS_WIN)
-  return has_reset_trigger;
-}

diff --git a/chrome/browser/ui/startup/startup_browser_creator_impl.h b/chrome/browser/ui/startup/startup_browser_creator_impl.h
index e8b6ece..e2beaf6 100644
--- a/chrome/browser/ui/startup/startup_browser_creator_impl.h
+++ b/chrome/browser/ui/startup/startup_browser_creator_impl.h

@@ -13,13 +13,14 @@
 #include "base/macros.h"
 #include "chrome/browser/sessions/session_restore.h"
 #include "chrome/browser/ui/startup/startup_tab.h"
-#include "chrome/browser/ui/startup/startup_tab_provider.h"
 #include "chrome/browser/ui/startup/startup_types.h"
 #include "url/gurl.h"
 
 class Browser;
 class Profile;
 class StartupBrowserCreator;
+class StartupTabProvider;
+struct SessionStartupPref;
 
 namespace base {
 class CommandLine;
@@ -134,9 +135,8 @@
   // Determines the URLs to be shown at startup by way of various policies
   // (onboarding, pinned tabs, etc.), determines whether a session restore
   // is necessary, and opens the URLs in a new or restored browser accordingly.
-  void ProcessLaunchUrlsUsingConsolidatedFlow(
-      bool process_startup,
-      const std::vector<GURL>& cmd_line_urls);
+  void DetermineURLsAndLaunch(bool process_startup,
+                              const std::vector<GURL>& cmd_line_urls);
 
   // Returns the tabs to be shown on startup, based on the policy functions in
   // the given StartupTabProvider, the given tabs passed by the command line,
@@ -164,9 +164,6 @@
     SessionRestore::BehaviorBitmask restore_options, bool process_startup,
     bool is_post_crash_launch);
 
-  // Adds a Tab to |tabs| for each url in |urls| that doesn't already exist
-  // in |tabs|.
-  void AddUniqueURLs(const std::vector<GURL>& urls, StartupTabs* tabs);
 
   // Adds any startup infobars to the selected tab of the given browser.
   void AddInfoBarsIfNecessary(
@@ -188,63 +185,11 @@
       bool has_create_browser_switch,
       bool was_mac_login_or_resume);
 
-  // TODO(crbug.com/651465): The following functions are deprecated. They will
-  // be removed once kUseConsolidatedStartupFlow is enabled by default.
-
-  // Invoked from Launch to handle processing of urls. This may do any of the
-  // following:
-  // . Invoke ProcessStartupURLs if |process_startup| is true.
-  // . If |process_startup| is false, restore the last session if necessary,
-  //   or invoke ProcessSpecifiedURLs.
-  // . Open the urls directly.
-  // Under the kUseConsolidatedStartupFlow feature, this is replaced by
-  // ProcessLaunchUrlsUsingConsolidatedFlow().
-  void ProcessLaunchURLs(bool process_startup,
-                         const std::vector<GURL>& urls_to_open);
-
-  // Does the following:
-  // . If the user's startup pref is to restore the last session (or the
-  //   command line flag is present to force using last session), it is
-  //   restored.
-  // . Otherwise invoke ProcessSpecifiedURLs
-  // If a browser was created, true is returned.  Otherwise returns false and
-  // the caller must create a new browser.
-  bool ProcessStartupURLs(const std::vector<GURL>& urls_to_open);
-
-  // Invoked from either ProcessLaunchURLs or ProcessStartupURLs to handle
-  // processing of URLs where the behavior is common between process startup
-  // and launch via an existing process (i.e. those explicitly specified by
-  // the user somehow).  Does the following:
-  // . Attempts to restore any pinned tabs from last run of chrome.
-  // . If urls_to_open is non-empty, they are opened.
-  // . If the user's startup pref is to launch a specific set of URLs they
-  //   are opened.
-  //
-  // If any tabs were opened, the Browser which was created is returned.
-  // Otherwise null is returned and the caller must create a new browser.
-  Browser* ProcessSpecifiedURLs(const std::vector<GURL>& urls_to_open);
-
-  // Adds additional startup URLs to the specified vector.
-  void AddStartupURLs(std::vector<GURL>* startup_urls) const;
-
-  // Adds special URLs to the specified vector. These URLs are triggered by
-  // special-case logic, such as profile reset or presentation of the welcome
-  // page.
-  void AddSpecialURLs(std::vector<GURL>* startup_urls) const;
-
-  // Initializes |welcome_run_type_| for this launch. Also persists state to
-  // suppress injecting the welcome page for future launches.
-  void InitializeWelcomeRunType(const std::vector<GURL>& urls_to_open);
-
-  // Checks whether |profile_| has a reset trigger set.
-  bool ProfileHasResetTrigger() const;
-
   const base::FilePath cur_dir_;
   const base::CommandLine& command_line_;
   Profile* profile_;
   StartupBrowserCreator* browser_creator_;
   bool is_first_run_;
-  WelcomeRunType welcome_run_type_;
   DISALLOW_COPY_AND_ASSIGN(StartupBrowserCreatorImpl);
 };
 

diff --git a/chrome/browser/ui/startup/startup_browser_creator_triggered_reset_browsertest_win.cc b/chrome/browser/ui/startup/startup_browser_creator_triggered_reset_browsertest_win.cc
index 2c306aca..04dfb6d 100644
--- a/chrome/browser/ui/startup/startup_browser_creator_triggered_reset_browsertest_win.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator_triggered_reset_browsertest_win.cc

@@ -22,6 +22,7 @@
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
+#include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/startup/startup_browser_creator.h"
 #include "chrome/browser/ui/startup/startup_browser_creator_impl.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ -73,6 +74,11 @@
   return base::WrapUnique(new MockTriggeredProfileResetter);
 }
 
+GURL GetTriggeredResetSettingsURL() {
+  return GURL(
+      chrome::GetSettingsUrl(chrome::kTriggeredResetProfileSettingsSubPage));
+}
+
 }  // namespace
 
 class StartupBrowserCreatorTriggeredResetTest : public InProcessBrowserTest {
@@ -148,8 +154,7 @@
   ASSERT_TRUE(new_browser);
 
   std::vector<GURL> expected_urls(urls);
-  expected_urls.insert(expected_urls.begin(),
-                       internals::GetTriggeredResetSettingsURL());
+  expected_urls.insert(expected_urls.begin(), GetTriggeredResetSettingsURL());
 
   TabStripModel* tab_strip = new_browser->tab_strip_model();
   ASSERT_EQ(static_cast<int>(expected_urls.size()), tab_strip->count());
@@ -273,6 +278,6 @@
   // Check for the expected reset dialog in the second browser too.
   TabStripModel* other_tab_strip = other_profile_browser->tab_strip_model();
   ASSERT_LT(0, other_tab_strip->count());
-  EXPECT_EQ(internals::GetTriggeredResetSettingsURL(),
+  EXPECT_EQ(GetTriggeredResetSettingsURL(),
             other_tab_strip->GetActiveWebContents()->GetURL());
 }

diff --git a/chrome/browser/ui/startup/startup_features.cc b/chrome/browser/ui/startup/startup_features.cc
index 0d3b7cb9..8daa9ee1 100644
--- a/chrome/browser/ui/startup/startup_features.cc
+++ b/chrome/browser/ui/startup/startup_features.cc

@@ -6,13 +6,7 @@
 
 namespace features {
 
-const base::Feature kUseConsolidatedStartupFlow{
-    "UseConsolidatedStartupFlow", base::FEATURE_ENABLED_BY_DEFAULT};
-
 #if defined(OS_WIN)
-const base::Feature kEnableWelcomeWin10{"EnableWelcomeWin10",
-                                        base::FEATURE_ENABLED_BY_DEFAULT};
-
 const base::Feature kWelcomeWin10InlineStyle{"WelcomeWin10InlineStyle",
                                              base::FEATURE_ENABLED_BY_DEFAULT};
 #endif

diff --git a/chrome/browser/ui/startup/startup_features.h b/chrome/browser/ui/startup/startup_features.h
index 92951fce..67cd9242 100644
--- a/chrome/browser/ui/startup/startup_features.h
+++ b/chrome/browser/ui/startup/startup_features.h

@@ -9,10 +9,7 @@
 
 namespace features {
 
-extern const base::Feature kUseConsolidatedStartupFlow;
-
 #if defined(OS_WIN)
-extern const base::Feature kEnableWelcomeWin10;
 extern const base::Feature kWelcomeWin10InlineStyle;
 #endif
 

diff --git a/chrome/browser/ui/views/OWNERS b/chrome/browser/ui/views/OWNERS
index 94ffd42..b76ce381 100644
--- a/chrome/browser/ui/views/OWNERS
+++ b/chrome/browser/ui/views/OWNERS

@@ -1,3 +1,4 @@
+bsep@chromium.org
 msw@chromium.org
 pkasting@chromium.org
 sky@chromium.org

diff --git a/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc b/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc
index 434bca4..5192f15 100644
--- a/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc
+++ b/chrome/browser/ui/views/accessibility/navigation_accessibility_uitest_win.cc

@@ -4,6 +4,7 @@
 
 #include <oleacc.h>
 
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/strings/string_util.h"
 #include "base/win/scoped_bstr.h"
@@ -70,7 +71,7 @@
     LONG child_id;
   };
 
-  std::deque<EventInfo> event_queue_;
+  base::circular_deque<EventInfo> event_queue_;
   scoped_refptr<content::MessageLoopRunner> loop_runner_;
   HWINEVENTHOOK win_event_hook_handle_;
   static WinAccessibilityEventMonitor* instance_;

diff --git a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc
index 46b8824..345e78d 100644
--- a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc
+++ b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.cc

@@ -225,25 +225,29 @@
   ui::WindowShowState restore_state = widget()->GetNativeWindow()->GetProperty(
       aura::client::kPreMinimizedShowStateKey);
 
+  bool is_fullscreen = false;
   if (widget()->GetNativeWindow()->GetProperty(
           ash::kRestoreBoundsOverrideKey)) {
-    // If an override is given, we use that restore state (after filtering).
+    // If an override is given, use that restore state, unless the window is in
+    // immersive fullscreen.
     restore_state = widget()->GetNativeWindow()->GetProperty(
         ash::kRestoreShowStateOverrideKey);
+    is_fullscreen = restore_state == ui::SHOW_STATE_FULLSCREEN;
   } else {
-    // Otherwise first normal states are checked.
     if (IsMaximized())
       return ui::SHOW_STATE_MAXIMIZED;
-    if (IsFullscreen()) {
-      if (immersive_fullscreen_controller_.get() &&
-          immersive_fullscreen_controller_->IsEnabled()) {
-        // Restore windows which were previously in immersive fullscreen to
-        // maximized. Restoring the window to a different fullscreen type
-        // makes for a bad experience.
-        return ui::SHOW_STATE_MAXIMIZED;
-      }
-      return ui::SHOW_STATE_FULLSCREEN;
+    is_fullscreen = IsFullscreen();
+  }
+
+  if (is_fullscreen) {
+    if (immersive_fullscreen_controller_.get() &&
+        immersive_fullscreen_controller_->IsEnabled()) {
+      // Restore windows which were previously in immersive fullscreen to
+      // maximized. Restoring the window to a different fullscreen type
+      // makes for a bad experience.
+      return ui::SHOW_STATE_MAXIMIZED;
     }
+    return ui::SHOW_STATE_FULLSCREEN;
   }
 
   return GetRestorableState(restore_state);

diff --git a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.h b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.h
index 0d41e0a..e84f374 100644
--- a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.h
+++ b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.h

@@ -77,6 +77,8 @@
  private:
   FRIEND_TEST_ALL_PREFIXES(ChromeNativeAppWindowViewsAuraAshBrowserTest,
                            ImmersiveWorkFlow);
+  FRIEND_TEST_ALL_PREFIXES(ChromeNativeAppWindowViewsAuraAshBrowserTest,
+                           ImmersiveModeFullscreenRestoreType);
   FRIEND_TEST_ALL_PREFIXES(ShapedAppWindowTargeterTest,
                            ResizeInsetsWithinBounds);
 

diff --git a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash_browsertest.cc b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash_browsertest.cc
index a5a67cf7..7b5fb927 100644
--- a/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash_browsertest.cc
+++ b/chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash_browsertest.cc

@@ -9,6 +9,7 @@
 #include "chrome/browser/apps/app_browsertest_util.h"
 #include "chrome/browser/ui/views/apps/chrome_native_app_window_views_aura_ash.h"
 #include "extensions/browser/app_window/app_window.h"
+#include "ui/base/ui_base_types.h"
 
 class ChromeNativeAppWindowViewsAuraAshBrowserTest
     : public extensions::PlatformAppBrowserTest {
@@ -68,3 +69,26 @@
 
   CloseAppWindow(app_window);
 }
+
+// Verifies that apps in immersive fullscreen will have a restore state of
+// maximized.
+IN_PROC_BROWSER_TEST_F(ChromeNativeAppWindowViewsAuraAshBrowserTest,
+                       ImmersiveModeFullscreenRestoreType) {
+  extensions::AppWindow* app_window = CreateTestAppWindow("{}");
+  auto* window = static_cast<ChromeNativeAppWindowViewsAuraAsh*>(
+      GetNativeAppWindowForAppWindow(app_window));
+  ASSERT_TRUE(window != nullptr);
+  ASSERT_TRUE(window->immersive_fullscreen_controller_.get() != nullptr);
+
+  window->SetFullscreen(extensions::AppWindow::FULLSCREEN_TYPE_OS);
+  EXPECT_EQ(ui::SHOW_STATE_MAXIMIZED, window->GetRestoredState());
+  ash::Shell::Get()->tablet_mode_controller()->EnableTabletModeWindowManager(
+      true);
+  EXPECT_TRUE(window->IsFullscreen());
+  EXPECT_EQ(ui::SHOW_STATE_MAXIMIZED, window->GetRestoredState());
+  ash::Shell::Get()->tablet_mode_controller()->EnableTabletModeWindowManager(
+      false);
+  EXPECT_EQ(ui::SHOW_STATE_MAXIMIZED, window->GetRestoredState());
+
+  CloseAppWindow(app_window);
+}

diff --git a/chrome/browser/ui/views/frame/OWNERS b/chrome/browser/ui/views/frame/OWNERS
index d589f40..4ad14651 100644
--- a/chrome/browser/ui/views/frame/OWNERS
+++ b/chrome/browser/ui/views/frame/OWNERS

@@ -1,3 +1,4 @@
+bsep@chromium.org
 pkasting@chromium.org
 sky@chromium.org
 

diff --git a/chrome/browser/ui/webui/certificate_viewer_webui.cc b/chrome/browser/ui/webui/certificate_viewer_webui.cc
index caf4dd1..e1e7c7e1 100644
--- a/chrome/browser/ui/webui/certificate_viewer_webui.cc
+++ b/chrome/browser/ui/webui/certificate_viewer_webui.cc

@@ -27,6 +27,7 @@
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "content/public/browser/web_contents.h"
+#include "net/cert/x509_util_nss.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/geometry/size.h"
 
@@ -115,7 +116,12 @@
 void ShowCertificateViewer(WebContents* web_contents,
                            gfx::NativeWindow parent,
                            net::X509Certificate* cert) {
-  CertificateViewerDialog* dialog = new CertificateViewerDialog(cert);
+  net::ScopedCERTCertificateList nss_certs =
+      net::x509_util::CreateCERTCertificateListFromX509Certificate(cert);
+  if (nss_certs.empty())
+    return;
+  CertificateViewerDialog* dialog =
+      new CertificateViewerDialog(std::move(nss_certs));
   dialog->Show(web_contents, parent);
 }
 
@@ -123,13 +129,13 @@
 // CertificateViewerDialog
 
 CertificateViewerModalDialog::CertificateViewerModalDialog(
-    net::X509Certificate* cert)
-    : cert_(cert), webui_(NULL), window_(NULL) {
+    net::ScopedCERTCertificateList certs)
+    : nss_certs_(std::move(certs)), webui_(NULL), window_(NULL) {
   // Construct the dialog title from the certificate.
   title_ = l10n_util::GetStringFUTF16(
       IDS_CERT_INFO_DIALOG_TITLE,
       base::UTF8ToUTF16(
-          x509_certificate_model::GetTitle(cert_->os_cert_handle())));
+          x509_certificate_model::GetTitle(nss_certs_.front().get())));
 }
 
 CertificateViewerModalDialog::~CertificateViewerModalDialog() {
@@ -167,7 +173,8 @@
 void CertificateViewerModalDialog::GetWebUIMessageHandlers(
     std::vector<WebUIMessageHandler*>* handlers) const {
   handlers->push_back(new CertificateViewerDialogHandler(
-      const_cast<CertificateViewerModalDialog*>(this), cert_.get()));
+      const_cast<CertificateViewerModalDialog*>(this),
+      net::x509_util::DupCERTCertificateList(nss_certs_)));
 }
 
 void CertificateViewerModalDialog::GetDialogSize(gfx::Size* size) const {
@@ -182,14 +189,7 @@
   // Certificate information. The keys in this dictionary's general key
   // correspond to the IDs in the Html page.
   base::DictionaryValue cert_info;
-  net::X509Certificate::OSCertHandle cert_hnd = cert_->os_cert_handle();
-
-  // Get the certificate chain.
-  net::X509Certificate::OSCertHandles cert_chain;
-  cert_chain.push_back(cert_->os_cert_handle());
-  const net::X509Certificate::OSCertHandles& certs =
-      cert_->GetIntermediateCertificates();
-  cert_chain.insert(cert_chain.end(), certs.begin(), certs.end());
+  CERTCertificate* cert_hnd = nss_certs_.front().get();
 
   // Certificate usage.
   std::vector<std::string> usages;
@@ -207,10 +207,11 @@
   // Standard certificate details.
   const std::string alternative_text =
       l10n_util::GetStringUTF8(IDS_CERT_INFO_FIELD_NOT_PRESENT);
-  cert_info.SetString("general.title", l10n_util::GetStringFUTF8(
-      IDS_CERT_INFO_DIALOG_TITLE,
-      base::UTF8ToUTF16(x509_certificate_model::GetTitle(
-          cert_chain.front()))));
+  cert_info.SetString(
+      "general.title",
+      l10n_util::GetStringFUTF8(
+          IDS_CERT_INFO_DIALOG_TITLE,
+          base::UTF8ToUTF16(x509_certificate_model::GetTitle(cert_hnd))));
 
   // Issued to information.
   cert_info.SetString("general.issued-cn",
@@ -252,12 +253,13 @@
   // Certificate hierarchy is constructed from bottom up.
   std::unique_ptr<base::ListValue> children;
   int index = 0;
-  for (net::X509Certificate::OSCertHandles::const_iterator i =
-      cert_chain.begin(); i != cert_chain.end(); ++i, ++index) {
+  for (net::ScopedCERTCertificateList::const_iterator i = nss_certs_.begin();
+       i != nss_certs_.end(); ++i, ++index) {
     std::unique_ptr<base::DictionaryValue> cert_node(
         new base::DictionaryValue());
     base::ListValue cert_details;
-    cert_node->SetString("label", x509_certificate_model::GetTitle(*i).c_str());
+    cert_node->SetString("label",
+                         x509_certificate_model::GetTitle(i->get()).c_str());
     cert_node->SetDouble("payload.index", index);
     // Add the child from the previous iteration.
     if (children)
@@ -297,10 +299,9 @@
 ////////////////////////////////////////////////////////////////////////////////
 // CertificateViewerDialog
 
-CertificateViewerDialog::CertificateViewerDialog(net::X509Certificate* cert)
-    : CertificateViewerModalDialog(cert),
-      dialog_(NULL) {
-}
+CertificateViewerDialog::CertificateViewerDialog(
+    net::ScopedCERTCertificateList certs)
+    : CertificateViewerModalDialog(std::move(certs)), dialog_(NULL) {}
 
 CertificateViewerDialog::~CertificateViewerDialog() {
 }
@@ -330,13 +331,8 @@
 
 CertificateViewerDialogHandler::CertificateViewerDialogHandler(
     CertificateViewerModalDialog* dialog,
-    net::X509Certificate* cert)
-    : cert_(cert), dialog_(dialog) {
-  cert_chain_.push_back(cert_->os_cert_handle());
-  const net::X509Certificate::OSCertHandles& certs =
-      cert_->GetIntermediateCertificates();
-  cert_chain_.insert(cert_chain_.end(), certs.begin(), certs.end());
-}
+    net::ScopedCERTCertificateList cert_chain)
+    : dialog_(dialog), cert_chain_(std::move(cert_chain)) {}
 
 CertificateViewerDialogHandler::~CertificateViewerDialogHandler() {
 }
@@ -370,7 +366,7 @@
   if (cert_index < 0)
     return;
 
-  net::X509Certificate::OSCertHandle cert = cert_chain_[cert_index];
+  CERTCertificate* cert = cert_chain_[cert_index].get();
 
   CertNodeBuilder version_node(IDS_CERT_DETAILS_VERSION);
   std::string version = x509_certificate_model::GetVersion(cert);

diff --git a/chrome/browser/ui/webui/certificate_viewer_webui.h b/chrome/browser/ui/webui/certificate_viewer_webui.h
index 530dfb7e..bda5b2f 100644
--- a/chrome/browser/ui/webui/certificate_viewer_webui.h
+++ b/chrome/browser/ui/webui/certificate_viewer_webui.h

@@ -12,6 +12,7 @@
 #include "base/macros.h"
 #include "base/values.h"
 #include "content/public/browser/web_ui_message_handler.h"
+#include "net/cert/scoped_nss_types.h"
 #include "net/cert/x509_certificate.h"
 #include "ui/gfx/native_widget_types.h"
 #include "ui/web_dialogs/web_dialog_delegate.h"
@@ -30,8 +31,7 @@
   // Construct a certificate viewer for the passed in certificate. A reference
   // to the certificate pointer is added for the lifetime of the certificate
   // viewer.
-  explicit CertificateViewerModalDialog(
-      net::X509Certificate* cert);
+  explicit CertificateViewerModalDialog(net::ScopedCERTCertificateList certs);
   ~CertificateViewerModalDialog() override;
 
   virtual void Show(content::WebContents* web_contents,
@@ -55,8 +55,8 @@
                        bool* out_close_dialog) override;
   bool ShouldShowDialogTitle() const override;
 
-  // The certificate being viewed.
-  scoped_refptr<net::X509Certificate> cert_;
+  // The certificate chain, as NSS cert objects.
+  net::ScopedCERTCertificateList nss_certs_;
 
   // The title of the certificate viewer dialog, Certificate Viewer: CN.
   base::string16 title_;
@@ -76,7 +76,7 @@
   // Construct a certificate viewer for the passed in certificate. A reference
   // to the certificate pointer is added for the lifetime of the certificate
   // viewer.
-  explicit CertificateViewerDialog(net::X509Certificate* cert);
+  explicit CertificateViewerDialog(net::ScopedCERTCertificateList certs);
   ~CertificateViewerDialog() override;
 
   // CertificateViewerModalDialog overrides.
@@ -100,7 +100,7 @@
 class CertificateViewerDialogHandler : public content::WebUIMessageHandler {
  public:
   CertificateViewerDialogHandler(CertificateViewerModalDialog* dialog,
-                                 net::X509Certificate* cert);
+                                 net::ScopedCERTCertificateList cert_chain);
   ~CertificateViewerDialogHandler() override;
 
   // Overridden from WebUIMessageHandler
@@ -124,15 +124,11 @@
   // the index is out of range.
   int GetCertificateIndex(const base::ListValue* args) const;
 
-  // The certificate being viewed.
-  scoped_refptr<net::X509Certificate> cert_;
-
   // The dialog.
   CertificateViewerModalDialog* dialog_;
 
-  // The certificate chain. Does not take references, so only valid as long as
-  // |cert_| is.
-  net::X509Certificate::OSCertHandles cert_chain_;
+  // The certificate chain.
+  net::ScopedCERTCertificateList cert_chain_;
 
   DISALLOW_COPY_AND_ASSIGN(CertificateViewerDialogHandler);
 };

diff --git a/chrome/browser/ui/webui/certificates_handler.cc b/chrome/browser/ui/webui/certificates_handler.cc
index be434e55..d063db31 100644
--- a/chrome/browser/ui/webui/certificates_handler.cc
+++ b/chrome/browser/ui/webui/certificates_handler.cc

@@ -38,6 +38,7 @@
 #include "content/public/browser/web_contents.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
+#include "net/cert/x509_util_nss.h"
 #include "net/der/input.h"
 #include "net/der/parser.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -125,16 +126,16 @@
 
 // Struct to bind the Equals member function to an object for use in find_if.
 struct CertEquals {
-  explicit CertEquals(const net::X509Certificate* cert) : cert_(cert) {}
+  explicit CertEquals(CERTCertificate* cert) : cert_(cert) {}
   bool operator()(const scoped_refptr<net::X509Certificate> cert) const {
-    return cert_->Equals(cert.get());
+    return net::x509_util::IsSameCertificate(cert_, cert.get());
   }
-  const net::X509Certificate* cert_;
+  CERTCertificate* cert_;
 };
 
 // Determine whether a certificate was stored with web trust by a policy.
 bool IsPolicyInstalledWithWebTrust(const net::CertificateList& web_trust_certs,
-                                   net::X509Certificate* cert) {
+                                   CERTCertificate* cert) {
   return std::find_if(web_trust_certs.begin(), web_trust_certs.end(),
                       CertEquals(cert)) != web_trust_certs.end();
 }
@@ -189,15 +190,15 @@
   CertIdMap() {}
   ~CertIdMap() {}
 
-  std::string CertToId(net::X509Certificate* cert);
-  net::X509Certificate* IdToCert(const std::string& id);
-  net::X509Certificate* CallbackArgsToCert(const base::ListValue* args);
+  std::string CertToId(CERTCertificate* cert);
+  CERTCertificate* IdToCert(const std::string& id);
+  CERTCertificate* CallbackArgsToCert(const base::ListValue* args);
 
  private:
-  typedef std::map<net::X509Certificate*, int32_t> CertMap;
+  typedef std::map<CERTCertificate*, int32_t> CertMap;
 
   // Creates an ID for cert and looks up the cert for an ID.
-  base::IDMap<net::X509Certificate*> id_map_;
+  base::IDMap<net::ScopedCERTCertificate> id_map_;
 
   // Finds the ID for a cert.
   CertMap cert_map_;
@@ -205,31 +206,30 @@
   DISALLOW_COPY_AND_ASSIGN(CertIdMap);
 };
 
-std::string CertIdMap::CertToId(net::X509Certificate* cert) {
+std::string CertIdMap::CertToId(CERTCertificate* cert) {
   CertMap::const_iterator iter = cert_map_.find(cert);
   if (iter != cert_map_.end())
     return base::IntToString(iter->second);
 
-  int32_t new_id = id_map_.Add(cert);
+  int32_t new_id = id_map_.Add(net::x509_util::DupCERTCertificate(cert));
   cert_map_[cert] = new_id;
   return base::IntToString(new_id);
 }
 
-net::X509Certificate* CertIdMap::IdToCert(const std::string& id) {
+CERTCertificate* CertIdMap::IdToCert(const std::string& id) {
   int32_t cert_id = 0;
   if (!base::StringToInt(id, &cert_id))
-    return NULL;
+    return nullptr;
 
   return id_map_.Lookup(cert_id);
 }
 
-net::X509Certificate* CertIdMap::CallbackArgsToCert(
-    const base::ListValue* args) {
+CERTCertificate* CertIdMap::CallbackArgsToCert(const base::ListValue* args) {
   std::string node_id;
   if (!args->GetString(0, &node_id))
     return NULL;
 
-  net::X509Certificate* cert = IdToCert(node_id);
+  CERTCertificate* cert = IdToCert(node_id);
   if (!cert) {
     NOTREACHED();
     return NULL;
@@ -461,10 +461,14 @@
 }
 
 void CertificatesHandler::HandleViewCertificate(const base::ListValue* args) {
-  net::X509Certificate* cert = cert_id_map_->CallbackArgsToCert(args);
+  CERTCertificate* cert = cert_id_map_->CallbackArgsToCert(args);
   if (!cert)
     return;
-  ShowCertificateViewer(web_ui()->GetWebContents(), GetParentWindow(), cert);
+  net::ScopedCERTCertificateList certs;
+  certs.push_back(net::x509_util::DupCERTCertificate(cert));
+  CertificateViewerDialog* dialog =
+      new CertificateViewerDialog(std::move(certs));
+  dialog->Show(web_ui()->GetWebContents(), GetParentWindow());
 }
 
 void CertificatesHandler::AssignWebUICallbackId(const base::ListValue* args) {
@@ -481,7 +485,7 @@
   std::string node_id;
   CHECK(args->GetString(1, &node_id));
 
-  net::X509Certificate* cert = cert_id_map_->IdToCert(node_id);
+  CERTCertificate* cert = cert_id_map_->IdToCert(node_id);
   CHECK(cert);
 
   net::NSSCertDatabase::TrustBits trust_bits =
@@ -506,7 +510,7 @@
   std::string node_id;
   CHECK(args->GetString(1, &node_id));
 
-  net::X509Certificate* cert = cert_id_map_->IdToCert(node_id);
+  CERTCertificate* cert = cert_id_map_->IdToCert(node_id);
   CHECK(cert);
 
   bool trust_ssl = false;
@@ -539,9 +543,9 @@
   std::string node_id;
   CHECK(args->GetString(1, &node_id));
 
-  net::X509Certificate* cert = cert_id_map_->IdToCert(node_id);
+  CERTCertificate* cert = cert_id_map_->IdToCert(node_id);
   CHECK(cert);
-  selected_cert_list_.push_back(cert);
+  selected_cert_list_.push_back(net::x509_util::DupCERTCertificate(cert));
 
   ui::SelectFileDialog::FileTypeInfo file_type_info;
   file_type_info.extensions.resize(1);
@@ -815,7 +819,7 @@
     return;
   }
 
-  selected_cert_list_ = net::X509Certificate::CreateCertificateListFromBytes(
+  selected_cert_list_ = net::x509_util::CreateCERTCertificateListFromBytes(
       data->data(), data->size(), net::X509Certificate::FORMAT_AUTO);
   if (selected_cert_list_.empty()) {
     ImportExportCleanup();
@@ -882,7 +886,7 @@
     return;
   }
 
-  selected_cert_list_ = net::X509Certificate::CreateCertificateListFromBytes(
+  selected_cert_list_ = net::x509_util::CreateCERTCertificateListFromBytes(
       data->data(), data->size(), net::X509Certificate::FORMAT_AUTO);
   if (selected_cert_list_.empty()) {
     ImportExportCleanup();
@@ -894,13 +898,14 @@
     return;
   }
 
-  scoped_refptr<net::X509Certificate> root_cert =
+  CERTCertificate* root_cert =
       certificate_manager_model_->cert_db()->FindRootInList(
           selected_cert_list_);
 
   // TODO(mattm): check here if root_cert is not a CA cert and show error.
 
-  base::Value cert_name(root_cert->subject().GetDisplayName());
+  base::Value cert_name(
+      x509_certificate_model::GetSubjectDisplayName(root_cert));
   ResolveCallback(cert_name);
 }
 
@@ -943,10 +948,13 @@
 }
 
 void CertificatesHandler::HandleExportCertificate(const base::ListValue* args) {
-  net::X509Certificate* cert = cert_id_map_->CallbackArgsToCert(args);
+  CERTCertificate* cert = cert_id_map_->CallbackArgsToCert(args);
   if (!cert)
     return;
-  ShowCertExportDialog(web_ui()->GetWebContents(), GetParentWindow(), cert);
+  net::ScopedCERTCertificateList export_certs;
+  export_certs.push_back(net::x509_util::DupCERTCertificate(cert));
+  ShowCertExportDialog(web_ui()->GetWebContents(), GetParentWindow(),
+                       export_certs.begin(), export_certs.end());
 }
 
 void CertificatesHandler::HandleDeleteCertificate(const base::ListValue* args) {
@@ -955,7 +963,7 @@
   std::string node_id;
   CHECK(args->GetString(1, &node_id));
 
-  net::X509Certificate* cert = cert_id_map_->IdToCert(node_id);
+  CERTCertificate* cert = cert_id_map_->IdToCert(node_id);
   CHECK(cert);
 
   bool result = certificate_manager_model_->Delete(cert);
@@ -1039,15 +1047,16 @@
 
       // Populate second level (certs).
       auto subnodes = base::MakeUnique<base::ListValue>();
-      for (net::CertificateList::const_iterator org_cert_it = i->second.begin();
+      for (net::ScopedCERTCertificateList::const_iterator org_cert_it =
+               i->second.begin();
            org_cert_it != i->second.end(); ++org_cert_it) {
         std::unique_ptr<base::DictionaryValue> cert_dict(
             new base::DictionaryValue);
-        net::X509Certificate* cert = org_cert_it->get();
+        CERTCertificate* cert = org_cert_it->get();
         cert_dict->SetString(kKeyField, cert_id_map_->CertToId(cert));
         cert_dict->SetString(
             kNameField, certificate_manager_model_->GetColumnText(
-                            *cert, CertificateManagerModel::COL_SUBJECT_NAME));
+                            cert, CertificateManagerModel::COL_SUBJECT_NAME));
         cert_dict->SetBoolean(
             kReadonlyField,
             certificate_manager_model_->cert_db()->IsReadOnly(cert));

diff --git a/chrome/browser/ui/webui/certificates_handler.h b/chrome/browser/ui/webui/certificates_handler.h
index 04d605c..fa60476 100644
--- a/chrome/browser/ui/webui/certificates_handler.h
+++ b/chrome/browser/ui/webui/certificates_handler.h

@@ -177,7 +177,7 @@
   std::string webui_callback_id_;
   bool use_hardware_backed_;
   std::string file_data_;
-  net::CertificateList selected_cert_list_;
+  net::ScopedCERTCertificateList selected_cert_list_;
   scoped_refptr<ui::SelectFileDialog> select_file_dialog_;
   crypto::ScopedPK11Slot slot_;
 

diff --git a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
index 63189a7..e7e5756 100644
--- a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
+++ b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc

@@ -148,6 +148,7 @@
 #include "chrome/browser/ui/webui/chromeos/sim_unlock_ui.h"
 #include "chrome/browser/ui/webui/chromeos/slow_trace_ui.h"
 #include "chrome/browser/ui/webui/chromeos/slow_ui.h"
+#include "chrome/browser/ui/webui/sys_internals/sys_internals_ui.h"
 #include "chrome/browser/ui/webui/voice_search_ui.h"
 #include "components/proximity_auth/webui/proximity_auth_ui.h"
 #include "components/proximity_auth/webui/url_constants.h"
@@ -469,6 +470,9 @@
     return &NewWebUI<chromeos::SlowUI>;
   if (url.host_piece() == chrome::kChromeUISlowTraceHost)
     return &NewWebUI<chromeos::SlowTraceController>;
+  if (url.host_piece() == chrome::kChromeUISysInternalsHost &&
+      SysInternalsUI::IsEnabled())
+    return &NewWebUI<SysInternalsUI>;
   if (url.host_piece() == chrome::kChromeUIVoiceSearchHost)
     return &NewWebUI<VoiceSearchUI>;
 #if !defined(OFFICIAL_BUILD)

diff --git a/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.cc b/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.cc
index f77bd7f..bce381f 100644
--- a/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.cc

@@ -206,6 +206,8 @@
   // ToS then prefs::kArcEnabled is automatically reset in ArcSessionManager.
   profile->GetPrefs()->SetBoolean(prefs::kArcEnabled, true);
 
+  action_taken_ = false;
+
   ShowScreen(kScreenId);
 
   MaybeLoadPlayStoreToS(true);
@@ -217,7 +219,17 @@
 
 }
 
+bool ArcTermsOfServiceScreenHandler::NeedDispatchEventOnAction() {
+  if (action_taken_)
+    return false;
+  action_taken_ = true;
+  return true;
+}
+
 void ArcTermsOfServiceScreenHandler::HandleSkip() {
+  if (!NeedDispatchEventOnAction())
+    return;
+
   for (auto& observer : observer_list_)
     observer.OnSkip();
 }
@@ -225,6 +237,9 @@
 void ArcTermsOfServiceScreenHandler::HandleAccept(
     bool enable_backup_restore,
     bool enable_location_services) {
+  if (!NeedDispatchEventOnAction())
+    return;
+
   pref_handler_->EnableBackupRestore(enable_backup_restore);
   pref_handler_->EnableLocationService(enable_location_services);
   for (auto& observer : observer_list_)

diff --git a/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.h b/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.h
index 37d630b..fbdb0db 100644
--- a/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.h
+++ b/chrome/browser/ui/webui/chromeos/login/arc_terms_of_service_screen_handler.h

@@ -72,6 +72,8 @@
 
   void StartNetworkAndTimeZoneObserving();
 
+  bool NeedDispatchEventOnAction();
+
   // arc::ArcOptInPreferenceHandlerObserver:
   void OnMetricsModeChanged(bool enabled, bool managed) override;
   void OnBackupAndRestoreModeChanged(bool enabled, bool managed) override;
@@ -85,6 +87,9 @@
   // Indicates that we already started network and time zone observing.
   bool network_time_zone_observing_ = false;
 
+  // To filter out duplicate notifications from html.
+  bool action_taken_ = false;
+
   std::unique_ptr<arc::ArcOptInPreferenceHandler> pref_handler_;
 
   DISALLOW_COPY_AND_ASSIGN(ArcTermsOfServiceScreenHandler);

diff --git a/chrome/browser/ui/webui/chromeos/power_ui.cc b/chrome/browser/ui/webui/chromeos/power_ui.cc
index b593b02..b498a4ef 100644
--- a/chrome/browser/ui/webui/chromeos/power_ui.cc
+++ b/chrome/browser/ui/webui/chromeos/power_ui.cc

@@ -12,6 +12,7 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
+#include "base/containers/circular_deque.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/time/time.h"
@@ -84,8 +85,8 @@
 }
 
 void PowerMessageHandler::OnGetBatteryChargeData(const base::ListValue* value) {
-  const std::deque<PowerDataCollector::PowerSupplySample>& power_supply =
-      PowerDataCollector::Get()->power_supply_data();
+  const base::circular_deque<PowerDataCollector::PowerSupplySample>&
+      power_supply = PowerDataCollector::Get()->power_supply_data();
   base::ListValue js_power_supply_data;
   for (size_t i = 0; i < power_supply.size(); ++i) {
     const PowerDataCollector::PowerSupplySample& sample = power_supply[i];
@@ -145,8 +146,8 @@
 void PowerMessageHandler::GetJsSystemResumedData(base::ListValue *data) {
   DCHECK(data);
 
-  const std::deque<PowerDataCollector::SystemResumedSample>& system_resumed =
-      PowerDataCollector::Get()->system_resumed_data();
+  const base::circular_deque<PowerDataCollector::SystemResumedSample>&
+      system_resumed = PowerDataCollector::Get()->system_resumed_data();
   for (size_t i = 0; i < system_resumed.size(); ++i) {
     const PowerDataCollector::SystemResumedSample& sample = system_resumed[i];
     std::unique_ptr<base::DictionaryValue> element(new base::DictionaryValue);

diff --git a/chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.cc b/chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.cc
new file mode 100644
index 0000000..27f2e43
--- /dev/null
+++ b/chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.cc

@@ -0,0 +1,231 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.h"
+
+#include <inttypes.h>
+#include <cstdio>
+#include <sstream>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/files/file_util.h"
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "base/process/process_metrics.h"
+#include "base/sys_info.h"
+
+namespace {
+
+struct CpuInfo {
+  int kernel;
+  int user;
+  int idle;
+  int total;
+};
+
+// When counter overflow, it will restart from zero. |base::Value| do not
+// supports 64-bit integer, if we pass the counter as a double it may cause
+// problem. Therefore, we only use the last 31 bits of the counter and pass it
+// as a 32-bit signed integer.
+template <typename T>
+inline int ToCounter(T value) {
+  DCHECK_GE(value, T(0));
+  return static_cast<int>(value & SysInternalsMessageHandler::COUNTER_MAX);
+}
+
+bool ParseProcStatLine(const std::string& line, std::vector<CpuInfo>* infos) {
+  DCHECK(infos);
+  uint64_t user = 0;
+  uint64_t nice = 0;
+  uint64_t sys = 0;
+  uint64_t idle = 0;
+  uint32_t cpu_index = 0;
+  int vals =
+      sscanf(line.c_str(),
+             "cpu%" PRIu32 " %" PRIu64 " %" PRIu64 " %" PRIu64 " %" PRIu64,
+             &cpu_index, &user, &nice, &sys, &idle);
+  if (vals != 5 || cpu_index >= infos->size()) {
+    NOTREACHED();
+    return false;
+  }
+
+  CpuInfo& cpu_info = (*infos)[cpu_index];
+  cpu_info.kernel = ToCounter(sys);
+  cpu_info.user = ToCounter(user + nice);
+  cpu_info.idle = ToCounter(idle);
+  cpu_info.total = ToCounter(sys + user + nice + idle);
+
+  return true;
+}
+
+bool GetCpuInfo(std::vector<CpuInfo>* infos) {
+  DCHECK(infos);
+
+  // WARNING: this method may return incomplete data because some processors may
+  // be brought offline at runtime. /proc/stat does not report statistics of
+  // offline processors. CPU usages of offline processors will be filled with
+  // zeros.
+  //
+  // An example of output of /proc/stat when processor 0 and 3 are online, but
+  // processor 1 and 2 are offline:
+  //
+  //   cpu  145292 20018 83444 1485410 995 44 3578 0 0 0
+  //   cpu0 138060 19947 78350 1479514 570 44 3576 0 0 0
+  //   cpu3 2033 32 1075 1400 52 0 1 0 0 0
+  const char kProcStat[] = "/proc/stat";
+  std::string contents;
+  if (!base::ReadFileToString(base::FilePath(kProcStat), &contents))
+    return false;
+
+  std::istringstream iss(contents);
+  std::string line;
+
+  // Skip the first line because it is just an aggregated number of
+  // all cpuN lines.
+  std::getline(iss, line);
+  while (std::getline(iss, line)) {
+    if (line.compare(0, 3, "cpu") != 0)
+      continue;
+    if (!ParseProcStatLine(line, infos))
+      return false;
+  }
+
+  return true;
+}
+
+void SetConstValue(base::Value* result) {
+  DCHECK(result);
+  int counter_max = static_cast<int>(SysInternalsMessageHandler::COUNTER_MAX);
+  result->SetPath({"const", "counterMax"}, base::Value(counter_max));
+}
+
+void SetCpusValue(const std::vector<CpuInfo>& infos, base::Value* result) {
+  DCHECK(result);
+  base::Value cpu_results(base::Value::Type::LIST);
+  for (const CpuInfo& cpu : infos) {
+    base::Value cpu_result(base::Value::Type::DICTIONARY);
+    cpu_result.SetKey("user", base::Value(cpu.user));
+    cpu_result.SetKey("kernel", base::Value(cpu.kernel));
+    cpu_result.SetKey("idle", base::Value(cpu.idle));
+    cpu_result.SetKey("total", base::Value(cpu.total));
+    cpu_results.GetList().push_back(std::move(cpu_result));
+  }
+  result->SetKey("cpus", std::move(cpu_results));
+}
+
+const double kBytesInKB = 1024;
+
+double GetAvailablePhysicalMemory(const base::SystemMemoryInfoKB& info) {
+  double available = static_cast<double>(
+      info.available == 0 ? info.free + info.reclaimable : info.available);
+
+  return available * kBytesInKB;
+}
+
+void SetMemValue(const base::SystemMemoryInfoKB& info, base::Value* result) {
+  DCHECK(result);
+  base::Value mem_result(base::Value::Type::DICTIONARY);
+
+  // For values that may exceed the range of 32-bit signed integer, use double.
+  double total = static_cast<double>(info.total) * kBytesInKB;
+  mem_result.SetKey("total", base::Value(total));
+  mem_result.SetKey("available", base::Value(GetAvailablePhysicalMemory(info)));
+  double swap_total = static_cast<double>(info.swap_total) * kBytesInKB;
+  mem_result.SetKey("swapTotal", base::Value(swap_total));
+  double swap_free = static_cast<double>(info.swap_free) * kBytesInKB;
+  mem_result.SetKey("swapFree", base::Value(swap_free));
+
+  mem_result.SetKey("pswpin", base::Value(ToCounter(info.pswpin)));
+  mem_result.SetKey("pswpout", base::Value(ToCounter(info.pswpout)));
+
+  result->SetKey("memory", std::move(mem_result));
+}
+
+void SetZramValue(const base::SwapInfo& info, base::Value* result) {
+  DCHECK(result);
+  base::Value zram_result(base::Value::Type::DICTIONARY);
+
+  zram_result.SetKey("numReads", base::Value(ToCounter(info.num_reads)));
+  zram_result.SetKey("numWrites", base::Value(ToCounter(info.num_writes)));
+
+  // For values that may exceed the range of 32-bit signed integer, use double.
+  zram_result.SetKey("comprDataSize",
+                     base::Value(static_cast<double>(info.compr_data_size)));
+  zram_result.SetKey("origDataSize",
+                     base::Value(static_cast<double>(info.orig_data_size)));
+  zram_result.SetKey("memUsedTotal",
+                     base::Value(static_cast<double>(info.mem_used_total)));
+
+  result->SetKey("zram", std::move(zram_result));
+}
+
+std::unique_ptr<base::Value> GetSysInfo() {
+  std::vector<CpuInfo> cpu_infos(base::SysInfo::NumberOfProcessors());
+  if (!GetCpuInfo(&cpu_infos)) {
+    DLOG(WARNING) << "Failed to get system CPU info.";
+    cpu_infos.clear();
+  }
+  base::SystemMemoryInfoKB mem_info;
+  if (!GetSystemMemoryInfo(&mem_info)) {
+    DLOG(WARNING) << "Failed to get system memory info.";
+  }
+  base::SwapInfo swap_info;
+  if (!GetSwapInfo(&swap_info)) {
+    DLOG(WARNING) << ("Failed to get system zram info.");
+  }
+
+  base::Value result(base::Value::Type::DICTIONARY);
+  SetConstValue(&result);
+  SetCpusValue(cpu_infos, &result);
+  SetMemValue(mem_info, &result);
+  SetZramValue(swap_info, &result);
+
+  return base::MakeUnique<base::Value>(std::move(result));
+}
+
+}  // namespace
+
+SysInternalsMessageHandler::SysInternalsMessageHandler()
+    : weak_ptr_factory_(this) {}
+
+SysInternalsMessageHandler::~SysInternalsMessageHandler() {}
+
+void SysInternalsMessageHandler::RegisterMessages() {
+  web_ui()->RegisterMessageCallback(
+      "getSysInfo", base::Bind(&SysInternalsMessageHandler::HandleGetSysInfo,
+                               base::Unretained(this)));
+}
+
+void SysInternalsMessageHandler::HandleGetSysInfo(const base::ListValue* args) {
+  AllowJavascript();
+  DCHECK(args);
+
+  const base::Value::ListStorage& list = args->GetList();
+  DCHECK_EQ(1U, list.size());
+  if (list.size() != 1U)
+    return;
+
+  DCHECK(list[0].is_string());
+  if (!list[0].is_string())
+    return;
+
+  std::unique_ptr<base::Value> callback_id =
+      base::MakeUnique<base::Value>(list[0].Clone());
+
+  base::PostTaskWithTraitsAndReplyWithResult(
+      FROM_HERE, base::MayBlock(), base::BindOnce(&GetSysInfo),
+      base::BindOnce(&SysInternalsMessageHandler::ReplySysInfo,
+                     weak_ptr_factory_.GetWeakPtr(), std::move(callback_id)));
+}
+
+void SysInternalsMessageHandler::ReplySysInfo(
+    std::unique_ptr<base::Value> callback_id,
+    std::unique_ptr<base::Value> result) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  ResolveJavascriptCallback(*callback_id, *result);
+}

diff --git a/chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.h b/chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.h
new file mode 100644
index 0000000..1c5c3dc
--- /dev/null
+++ b/chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.h

@@ -0,0 +1,77 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_WEBUI_SYS_INTERNALS_SYS_INTERNALS_MESSAGE_HANDLER_H_
+#define CHROME_BROWSER_UI_WEBUI_SYS_INTERNALS_SYS_INTERNALS_MESSAGE_HANDLER_H_
+
+#include <stdint.h>
+#include <memory>
+
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/threading/thread_checker.h"
+#include "base/values.h"
+#include "content/public/browser/web_ui_message_handler.h"
+
+// The handler class for SysInternals page operations.
+class SysInternalsMessageHandler : public content::WebUIMessageHandler {
+ public:
+  SysInternalsMessageHandler();
+  ~SysInternalsMessageHandler() override;
+
+  // content::WebUIMessageHandler methods:
+  void RegisterMessages() override;
+
+  // Because the |base::Value| API only supports 32-bit signed integer,
+  // we need to make sure every counter is less than the maximum value.
+  // See |ToCounter()| in |sys_internals_message_handler.cc|.
+  static const uint32_t COUNTER_MAX = 0x7FFFFFFFu;
+
+ private:
+  THREAD_CHECKER(thread_checker_);
+
+  base::WeakPtrFactory<SysInternalsMessageHandler> weak_ptr_factory_;
+
+  // Handle the Javascript message |getSysInfo|. The message is sent to get
+  // system information.
+  void HandleGetSysInfo(const base::ListValue* args);
+
+  // The callback function to handle the returning data.
+  //
+  // |result|: {
+  //   const: {
+  //     counterMax (Integer: The maximum value of all counters)
+  //   }
+  //   cpus (Array): [ CpuInfo... ]
+  //   memory: {
+  //     available (bytes)
+  //     total (bytes)
+  //     swapFree (bytes)
+  //     swapTotal (bytes)
+  //     pswpin (counter)
+  //     pswpout (counter)
+  //   zram: {
+  //     origDataSize (bytes)
+  //     comprDataSize (bytes)
+  //     memUsedTotal (bytes)
+  //     numReads (counter)
+  //     numWrites (counter)
+  //   }
+  // }
+  //
+  // |CpuInfo|: {
+  //   kernel (counter)
+  //   user (counter)
+  //   idle (counter)
+  //   total (counter)
+  // }
+  //
+  void ReplySysInfo(std::unique_ptr<base::Value> callback_id,
+                    std::unique_ptr<base::Value> result);
+
+  DISALLOW_COPY_AND_ASSIGN(SysInternalsMessageHandler);
+};
+
+#endif  // CHROME_BROWSER_UI_WEBUI_SYS_INTERNALS_SYS_INTERNALS_MESSAGE_HANDLER_H_

diff --git a/chrome/browser/ui/webui/sys_internals/sys_internals_ui.cc b/chrome/browser/ui/webui/sys_internals/sys_internals_ui.cc
new file mode 100644
index 0000000..85de2b7a
--- /dev/null
+++ b/chrome/browser/ui/webui/sys_internals/sys_internals_ui.cc

@@ -0,0 +1,36 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/sys_internals/sys_internals_ui.h"
+
+#include "base/feature_list.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/ui/webui/sys_internals/sys_internals_message_handler.h"
+#include "chrome/common/chrome_features.h"
+#include "chrome/common/url_constants.h"
+#include "chrome/grit/browser_resources.h"
+#include "chrome/grit/generated_resources.h"
+#include "content/public/browser/web_ui.h"
+#include "content/public/browser/web_ui_data_source.h"
+
+SysInternalsUI::SysInternalsUI(content::WebUI* web_ui)
+    : content::WebUIController(web_ui) {
+  web_ui->AddMessageHandler(base::MakeUnique<SysInternalsMessageHandler>());
+
+  content::WebUIDataSource* html_source =
+      content::WebUIDataSource::Create(chrome::kChromeUISysInternalsHost);
+  html_source->AddResourcePath("index.css", IDR_SYS_INTERNALS_CSS);
+  html_source->AddResourcePath("index.js", IDR_SYS_INTERNALS_JS);
+  html_source->SetDefaultResource(IDR_SYS_INTERNALS_HTML);
+
+  Profile* profile = Profile::FromWebUI(web_ui);
+  content::WebUIDataSource::Add(profile, html_source);
+}
+
+SysInternalsUI::~SysInternalsUI() {}
+
+// static
+bool SysInternalsUI::IsEnabled() {
+  return base::FeatureList::IsEnabled(features::kSysInternals);
+}

diff --git a/chrome/browser/ui/webui/sys_internals/sys_internals_ui.h b/chrome/browser/ui/webui/sys_internals/sys_internals_ui.h
new file mode 100644
index 0000000..f42b3f8
--- /dev/null
+++ b/chrome/browser/ui/webui/sys_internals/sys_internals_ui.h

@@ -0,0 +1,23 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_WEBUI_SYS_INTERNALS_SYS_INTERNALS_UI_H_
+#define CHROME_BROWSER_UI_WEBUI_SYS_INTERNALS_SYS_INTERNALS_UI_H_
+
+#include "base/macros.h"
+#include "content/public/browser/web_ui_controller.h"
+
+// The UI controller for SysInternals page.
+class SysInternalsUI : public content::WebUIController {
+ public:
+  explicit SysInternalsUI(content::WebUI* web_ui);
+  ~SysInternalsUI() override;
+
+  static bool IsEnabled();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SysInternalsUI);
+};
+
+#endif  // CHROME_BROWSER_UI_WEBUI_SYS_INTERNALS_SYS_INTERNALS_UI_H_

diff --git a/chrome/browser/vr/BUILD.gn b/chrome/browser/vr/BUILD.gn
index 11480b8..4a1387f 100644
--- a/chrome/browser/vr/BUILD.gn
+++ b/chrome/browser/vr/BUILD.gn

@@ -161,6 +161,8 @@
     "test/animation_utils.cc",
     "test/animation_utils.h",
     "test/constants.h",
+    "test/fake_ui_element_renderer.cc",
+    "test/fake_ui_element_renderer.h",
     "test/mock_browser_interface.cc",
     "test/mock_browser_interface.h",
     "test/mock_content_input_delegate.cc",

diff --git a/chrome/browser/vr/elements/content_element.cc b/chrome/browser/vr/elements/content_element.cc
index 1b4e817..e14d832 100644
--- a/chrome/browser/vr/elements/content_element.cc
+++ b/chrome/browser/vr/elements/content_element.cc

@@ -25,7 +25,7 @@
   gfx::RectF copy_rect(0, 0, 1, 1);
   renderer->DrawTexturedQuad(
       texture_id_, UiElementRenderer::kTextureLocationExternal,
-      view_proj_matrix, copy_rect, opacity(), size(), corner_radius());
+      view_proj_matrix, copy_rect, computed_opacity(), size(), corner_radius());
 }
 
 void ContentElement::OnHoverEnter(const gfx::PointF& position) {

diff --git a/chrome/browser/vr/elements/grid.cc b/chrome/browser/vr/elements/grid.cc
index c80a3fc..60f93aa 100644
--- a/chrome/browser/vr/elements/grid.cc
+++ b/chrome/browser/vr/elements/grid.cc

@@ -30,7 +30,8 @@
 void Grid::Render(UiElementRenderer* renderer,
                   const gfx::Transform& view_proj_matrix) const {
   renderer->DrawGradientGridQuad(view_proj_matrix, edge_color(), center_color(),
-                                 grid_color_, gridline_count_, opacity());
+                                 grid_color_, gridline_count_,
+                                 computed_opacity());
 }
 
 }  // namespace vr

diff --git a/chrome/browser/vr/elements/rect.cc b/chrome/browser/vr/elements/rect.cc
index 045ff26..583973f 100644
--- a/chrome/browser/vr/elements/rect.cc
+++ b/chrome/browser/vr/elements/rect.cc

@@ -38,7 +38,7 @@
 void Rect::Render(UiElementRenderer* renderer,
                   const gfx::Transform& view_proj_matrix) const {
   renderer->DrawGradientQuad(view_proj_matrix, edge_color_, center_color_,
-                             opacity(), size(), corner_radius());
+                             computed_opacity(), size(), corner_radius());
 }
 
 }  // namespace vr

diff --git a/chrome/browser/vr/elements/textured_element.cc b/chrome/browser/vr/elements/textured_element.cc
index 3b12764..de2c1a6 100644
--- a/chrome/browser/vr/elements/textured_element.cc
+++ b/chrome/browser/vr/elements/textured_element.cc

@@ -55,7 +55,12 @@
                        drawn_size.height() / texture_size_.height());
   renderer->DrawTexturedQuad(
       texture_handle_, UiElementRenderer::kTextureLocationLocal,
-      view_proj_matrix, copy_rect, opacity(), size(), corner_radius());
+      view_proj_matrix, copy_rect, computed_opacity(), size(), corner_radius());
+}
+
+void TexturedElement::SetInitializedForTesting() {
+  initialized_ = true;
+  GetTexture()->set_ready_for_testing();
 }
 
 void TexturedElement::Flush(SkSurface* surface) {

diff --git a/chrome/browser/vr/elements/textured_element.h b/chrome/browser/vr/elements/textured_element.h
index 5b0c9af..a9a0203 100644
--- a/chrome/browser/vr/elements/textured_element.h
+++ b/chrome/browser/vr/elements/textured_element.h

@@ -30,6 +30,8 @@
   void Render(UiElementRenderer* renderer,
               const gfx::Transform& view_proj_matrix) const final;
 
+  void SetInitializedForTesting();
+
  protected:
   void UpdateTexture();
 

diff --git a/chrome/browser/vr/elements/ui_element.cc b/chrome/browser/vr/elements/ui_element.cc
index c30b2149..b9e2d47 100644
--- a/chrome/browser/vr/elements/ui_element.cc
+++ b/chrome/browser/vr/elements/ui_element.cc

@@ -26,12 +26,12 @@
                          const gfx::Point3F& plane_origin,
                          const gfx::Vector3dF& plane_normal,
                          float* distance) {
-  float denom = gfx::DotProduct(ray_vector, plane_normal);
+  float denom = gfx::DotProduct(-ray_vector, plane_normal);
   if (denom == 0) {
     return false;
   }
   gfx::Vector3dF rel = ray_origin - plane_origin;
-  *distance = -gfx::DotProduct(plane_normal, rel) / denom;
+  *distance = gfx::DotProduct(plane_normal, rel) / denom;
   return true;
 }
 
@@ -209,7 +209,7 @@
   gfx::Vector3dF y_axis(0, 1, 0);
   world_space_transform_.TransformVector(&x_axis);
   world_space_transform_.TransformVector(&y_axis);
-  gfx::Vector3dF normal = CrossProduct(y_axis, x_axis);
+  gfx::Vector3dF normal = CrossProduct(x_axis, y_axis);
   normal.GetNormalized(&normal);
   return normal;
 }

diff --git a/chrome/browser/vr/elements/ui_texture.h b/chrome/browser/vr/elements/ui_texture.h
index 85504d06..54a4c15 100644
--- a/chrome/browser/vr/elements/ui_texture.h
+++ b/chrome/browser/vr/elements/ui_texture.h

@@ -39,6 +39,7 @@
   virtual bool HitTest(const gfx::PointF& point) const;
 
   bool dirty() const { return dirty_; }
+  void set_ready_for_testing() { dirty_ = false; }
 
   void SetMode(ColorScheme::Mode mode);
 

diff --git a/chrome/browser/vr/test/fake_ui_element_renderer.cc b/chrome/browser/vr/test/fake_ui_element_renderer.cc
new file mode 100644
index 0000000..f6ec0e5
--- /dev/null
+++ b/chrome/browser/vr/test/fake_ui_element_renderer.cc

@@ -0,0 +1,45 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/vr/test/fake_ui_element_renderer.h"
+
+#include "ui/gfx/geometry/size_f.h"
+
+namespace vr {
+
+FakeUiElementRenderer::FakeUiElementRenderer() {}
+FakeUiElementRenderer::~FakeUiElementRenderer() {}
+
+void FakeUiElementRenderer::DrawTexturedQuad(
+    int texture_data_handle,
+    TextureLocation texture_location,
+    const gfx::Transform& view_proj_matrix,
+    const gfx::RectF& copy_rect,
+    float opacity,
+    gfx::SizeF element_size,
+    float corner_radius) {
+  texture_opacity_ = opacity;
+}
+
+void FakeUiElementRenderer::DrawGradientQuad(
+    const gfx::Transform& view_proj_matrix,
+    const SkColor edge_color,
+    const SkColor center_color,
+    float opacity,
+    gfx::SizeF element_size,
+    float corner_radius) {
+  gradient_opacity_ = opacity;
+}
+
+void FakeUiElementRenderer::DrawGradientGridQuad(
+    const gfx::Transform& view_proj_matrix,
+    const SkColor edge_color,
+    const SkColor center_color,
+    const SkColor grid_color,
+    int gridline_count,
+    float opacity) {
+  grid_opacity_ = opacity;
+}
+
+}  // namespace vr

diff --git a/chrome/browser/vr/test/fake_ui_element_renderer.h b/chrome/browser/vr/test/fake_ui_element_renderer.h
new file mode 100644
index 0000000..93cdd85e
--- /dev/null
+++ b/chrome/browser/vr/test/fake_ui_element_renderer.h

@@ -0,0 +1,54 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_VR_TEST_FAKE_UI_ELEMENT_RENDERER_H_
+#define CHROME_BROWSER_VR_TEST_FAKE_UI_ELEMENT_RENDERER_H_
+
+#include "base/macros.h"
+#include "chrome/browser/vr/ui_element_renderer.h"
+
+namespace vr {
+
+class FakeUiElementRenderer : public UiElementRenderer {
+ public:
+  FakeUiElementRenderer();
+  ~FakeUiElementRenderer() override;
+
+  float texture_opacity() { return texture_opacity_; }
+  float gradient_opacity() { return gradient_opacity_; }
+  float grid_opacity() { return grid_opacity_; }
+
+  void DrawTexturedQuad(int texture_data_handle,
+                        TextureLocation texture_location,
+                        const gfx::Transform& view_proj_matrix,
+                        const gfx::RectF& copy_rect,
+                        float opacity,
+                        gfx::SizeF element_size,
+                        float corner_radius) override;
+
+  void DrawGradientQuad(const gfx::Transform& view_proj_matrix,
+                        const SkColor edge_color,
+                        const SkColor center_color,
+                        float opacity,
+                        gfx::SizeF element_size,
+                        float corner_radius) override;
+
+  void DrawGradientGridQuad(const gfx::Transform& view_proj_matrix,
+                            const SkColor edge_color,
+                            const SkColor center_color,
+                            const SkColor grid_color,
+                            int gridline_count,
+                            float opacity) override;
+
+ private:
+  float texture_opacity_ = -1.f;
+  float gradient_opacity_ = -1.f;
+  float grid_opacity_ = -1.f;
+
+  DISALLOW_COPY_AND_ASSIGN(FakeUiElementRenderer);
+};
+
+}  // namespace vr
+
+#endif  // CHROME_BROWSER_VR_TEST_FAKE_UI_ELEMENT_RENDERER_H_

diff --git a/chrome/browser/vr/test/ui_scene_manager_test.cc b/chrome/browser/vr/test/ui_scene_manager_test.cc
index 5ec689d6..130757d 100644
--- a/chrome/browser/vr/test/ui_scene_manager_test.cc
+++ b/chrome/browser/vr/test/ui_scene_manager_test.cc

@@ -12,6 +12,21 @@
 
 namespace vr {
 
+namespace {
+
+bool IsElementFacingCamera(const UiElement* element) {
+  // Element might become invisible due to incorrect rotation, i.e when rotation
+  // cause the visible side of the element flip.
+  // Here we calculate the dot product of (origin - center) and normal. If the
+  // result is greater than 0, it means the visible side of this element is
+  // facing camera.
+  gfx::Point3F center = element->GetCenter();
+  return gfx::DotProduct(-gfx::Vector3dF(center.x(), center.y(), center.z()),
+                         element->GetNormal()) > 0.f;
+}
+
+}  // namespace
+
 UiSceneManagerTest::UiSceneManagerTest() {}
 UiSceneManagerTest::~UiSceneManagerTest() {}
 
@@ -36,7 +51,10 @@
 bool UiSceneManagerTest::IsVisible(UiElementName name) const {
   scene_->root_element().UpdateInheritedProperties();
   UiElement* element = scene_->GetUiElementByName(name);
-  return element ? element->IsVisible() : false;
+  if (!element)
+    return false;
+
+  return element->IsVisible() && IsElementFacingCamera(element);
 }
 
 void UiSceneManagerTest::VerifyElementsVisible(
@@ -48,7 +66,7 @@
     SCOPED_TRACE(name);
     auto* element = scene_->GetUiElementByName(name);
     EXPECT_NE(nullptr, element);
-    EXPECT_TRUE(element->IsVisible());
+    EXPECT_TRUE(element->IsVisible() && IsElementFacingCamera(element));
   }
 }
 

diff --git a/chrome/browser/vr/ui_renderer.cc b/chrome/browser/vr/ui_renderer.cc
index 8a666f6dc..dc40975b 100644
--- a/chrome/browser/vr/ui_renderer.cc
+++ b/chrome/browser/vr/ui_renderer.cc

@@ -207,7 +207,7 @@
     // Make the reticle planar to the element it's hitting.
     rotation =
         gfx::Quaternion(gfx::Vector3dF(0.0f, 0.0f, -1.0f),
-                        controller_info.reticle_render_target->GetNormal());
+                        -controller_info.reticle_render_target->GetNormal());
   } else {
     // Rotate the reticle to directly face the eyes.
     rotation = gfx::Quaternion(gfx::Vector3dF(0.0f, 0.0f, -1.0f),

diff --git a/chrome/browser/vr/ui_scene_manager.cc b/chrome/browser/vr/ui_scene_manager.cc
index 41f7e94c..cd641eb 100644
--- a/chrome/browser/vr/ui_scene_manager.cc
+++ b/chrome/browser/vr/ui_scene_manager.cc

@@ -642,7 +642,7 @@
   element->SetSize(kToastWidthDMM, kToastHeightDMM);
   element->SetTranslate(0, kWebVrToastDistance * sin(kWebVrAngleRadians),
                         -kWebVrToastDistance * cos(kWebVrAngleRadians));
-  element->SetRotate(1, 0, 0, cc::MathUtil::Rad2Deg(kWebVrAngleRadians));
+  element->SetRotate(1, 0, 0, kWebVrAngleRadians);
   element->SetScale(kWebVrToastDistance, kWebVrToastDistance, 1);
   element->SetVisible(false);
   element->set_hit_testable(false);

diff --git a/chrome/browser/vr/ui_scene_manager_unittest.cc b/chrome/browser/vr/ui_scene_manager_unittest.cc
index b181e3e..c92a81d 100644
--- a/chrome/browser/vr/ui_scene_manager_unittest.cc
+++ b/chrome/browser/vr/ui_scene_manager_unittest.cc

@@ -9,11 +9,15 @@
 #include "base/test/scoped_mock_time_message_loop_task_runner.h"
 #include "cc/base/math_util.h"
 #include "chrome/browser/vr/color_scheme.h"
+#include "chrome/browser/vr/elements/content_element.h"
+#include "chrome/browser/vr/elements/grid.h"
+#include "chrome/browser/vr/elements/rect.h"
 #include "chrome/browser/vr/elements/ui_element.h"
 #include "chrome/browser/vr/elements/ui_element_name.h"
 #include "chrome/browser/vr/target_property.h"
 #include "chrome/browser/vr/test/animation_utils.h"
 #include "chrome/browser/vr/test/constants.h"
+#include "chrome/browser/vr/test/fake_ui_element_renderer.h"
 #include "chrome/browser/vr/test/mock_browser_interface.h"
 #include "chrome/browser/vr/test/ui_scene_manager_test.h"
 #include "chrome/browser/vr/ui_scene.h"
@@ -577,4 +581,49 @@
   manager_->OnProjMatrixChanged(kProjMatrix);
 }
 
+TEST_F(UiSceneManagerTest, ApplyParentOpacity) {
+  MakeManager(kNotInCct, kNotInWebVr);
+  FakeUiElementRenderer renderer;
+  auto grid_element = base::MakeUnique<Grid>();
+  grid_element->set_draw_phase(kPhaseForeground);
+  Grid* grid = grid_element.get();
+  scene_->AddUiElement(k2dBrowsingContentGroup, std::move(grid_element));
+  auto rect_element = base::MakeUnique<Rect>();
+  rect_element->set_draw_phase(kPhaseForeground);
+  Rect* rect = rect_element.get();
+  scene_->AddUiElement(k2dBrowsingContentGroup, std::move(rect_element));
+
+  ContentElement* content_quad =
+      static_cast<ContentElement*>(scene_->GetUiElementByName(kContentQuad));
+  content_quad->set_texture_id(1);
+  TexturedElement* textured_element =
+      static_cast<TexturedElement*>(scene_->GetUiElementByName(kExitPrompt));
+  textured_element->SetVisible(true);
+  textured_element->SetInitializedForTesting();
+
+  AnimateBy(MsToDelta(0));
+  content_quad->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.texture_opacity(), content_quad->computed_opacity());
+  textured_element->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.texture_opacity(),
+                  textured_element->computed_opacity());
+  grid->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.grid_opacity(), grid->computed_opacity());
+  rect->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.grid_opacity(), rect->computed_opacity());
+
+  // Change parent opacity.
+  scene_->GetUiElementByName(k2dBrowsingContentGroup)->SetOpacity(0.2);
+  AnimateBy(MsToDelta(0));
+  content_quad->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.texture_opacity(), content_quad->computed_opacity());
+  textured_element->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.texture_opacity(),
+                  textured_element->computed_opacity());
+  grid->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.grid_opacity(), grid->computed_opacity());
+  rect->Render(&renderer, kProjMatrix);
+  EXPECT_FLOAT_EQ(renderer.grid_opacity(), rect->computed_opacity());
+}
+
 }  // namespace vr

diff --git a/chrome/child/v8_breakpad_support_win.cc b/chrome/child/v8_breakpad_support_win.cc
index a86c8e12..93530d1 100644
--- a/chrome/child/v8_breakpad_support_win.cc
+++ b/chrome/child/v8_breakpad_support_win.cc

@@ -16,8 +16,10 @@
 
 void SetUp() {
 #if defined(ARCH_CPU_X86_64)
-  gin::Debug::SetCodeRangeCreatedCallback(&RegisterNonABICompliantCodeRange);
-  gin::Debug::SetCodeRangeDeletedCallback(&UnregisterNonABICompliantCodeRange);
+  gin::Debug::SetCodeRangeCreatedCallback(
+      &RegisterNonABICompliantCodeRange_ExportThunk);
+  gin::Debug::SetCodeRangeDeletedCallback(
+      &UnregisterNonABICompliantCodeRange_ExportThunk);
 #endif
 }
 

diff --git a/chrome/chrome_watcher/system_load_estimator_unittest.cc b/chrome/chrome_watcher/system_load_estimator_unittest.cc
index 3f39e26..8dad68a 100644
--- a/chrome/chrome_watcher/system_load_estimator_unittest.cc
+++ b/chrome/chrome_watcher/system_load_estimator_unittest.cc

@@ -4,10 +4,10 @@
 
 #include "chrome/chrome_watcher/system_load_estimator.h"
 
-#include <deque>
 #include <memory>
 #include <utility>
 
+#include "base/containers/circular_deque.h"
 #include "base/logging.h"
 #include "base/time/time.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -16,7 +16,7 @@
 
 using SystemLoadEstimator = chrome_watcher::SystemLoadEstimator;
 using TimePair = std::pair<uint64_t, uint64_t>;
-using TimePairQueue = std::deque<TimePair>;
+using TimePairQueue = base::circular_deque<TimePair>;
 
 class SystemLoadEstimatorForTest : public SystemLoadEstimator {
  public:

diff --git a/chrome/common/child_process_logging_win.cc b/chrome/common/child_process_logging_win.cc
index e434d073..b98f2ad 100644
--- a/chrome/common/child_process_logging_win.cc
+++ b/chrome/common/child_process_logging_win.cc

@@ -22,11 +22,11 @@
 
 void SetCrashKeyValueTrampoline(const base::StringPiece& key,
                                 const base::StringPiece& value) {
-  SetCrashKeyValueImplEx(key.data(), value.data());
+  SetCrashKeyValueEx_ExportThunk(key.data(), value.data());
 }
 
 void ClearCrashKeyValueTrampoline(const base::StringPiece& key) {
-  ClearCrashKeyValueImplEx(key.data());
+  ClearCrashKeyValueEx_ExportThunk(key.data());
 }
 
 }  // namespace

diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
index a1fe637..818baed 100644
--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc

@@ -423,6 +423,12 @@
 const base::Feature kSupervisedUserCreation{"SupervisedUserCreation",
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
+#if defined(OS_CHROMEOS)
+// Enables or disables chrome://sys-internals.
+const base::Feature kSysInternals{"SysInternals",
+                                  base::FEATURE_DISABLED_BY_DEFAULT};
+#endif
+
 #if defined(SYZYASAN)
 // Enable the deferred free mechanism in the syzyasan module, which helps the
 // performance by deferring some work on the critical path to a background

diff --git a/chrome/common/chrome_features.h b/chrome/common/chrome_features.h
index 38c69fec..30d7a3f 100644
--- a/chrome/common/chrome_features.h
+++ b/chrome/common/chrome_features.h

@@ -216,6 +216,10 @@
 
 extern const base::Feature kSupervisedUserCreation;
 
+#if defined(OS_CHROMEOS)
+extern const base::Feature kSysInternals;
+#endif
+
 #if defined(SYZYASAN)
 extern const base::Feature kSyzyasanDeferredFree;
 #endif

diff --git a/chrome/common/extensions/extension_constants.cc b/chrome/common/extensions/extension_constants.cc
index df59869..c0b50a9f 100644
--- a/chrome/common/extensions/extension_constants.cc
+++ b/chrome/common/extensions/extension_constants.cc

@@ -39,6 +39,8 @@
 const char kEnterpriseWebStoreAppId[] = "afchcafgojfnemjkcbhfekplkmjaldaa";
 const char kGmailAppId[] = "pjkljhegncpnkpknbcohdijeoejaedia";
 const char kGoogleDocAppId[] = "aohghmighlieiainnegkcijnfilokake";
+const char kGooglePlayBooksAppId[] = "mmimngoggfoobjdlefbcabngfnmieonb";
+const char kGooglePlayMoviesAppId[] = "gdijeikdkaembjbdobgfkoidjkpbmlkd";
 const char kGooglePlayMusicAppId[] = "icppfcnhkcmnfdhfhphakoifcfokfdhg";
 const char kGoogleSheetsAppId[] = "felcaaldnbdncclmgdcncolpebgiejap";
 const char kGoogleSlidesAppId[] = "aapocclcgogkmnckokdopfmhonfmgoek";

diff --git a/chrome/common/extensions/extension_constants.h b/chrome/common/extensions/extension_constants.h
index 78b22e0..43ef3bcd 100644
--- a/chrome/common/extensions/extension_constants.h
+++ b/chrome/common/extensions/extension_constants.h

@@ -61,6 +61,12 @@
 // The extension id of the Google Doc application.
 extern const char kGoogleDocAppId[];
 
+// The extension id of the Google Play Books application.
+extern const char kGooglePlayBooksAppId[];
+
+// The extension id of the Google Play Movies application.
+extern const char kGooglePlayMoviesAppId[];
+
 // The extension id of the Google Play Music application.
 extern const char kGooglePlayMusicAppId[];
 

diff --git a/chrome/common/net/x509_certificate_model_nss.cc b/chrome/common/net/x509_certificate_model_nss.cc
index 3f72ea5..58d7cc0 100644
--- a/chrome/common/net/x509_certificate_model_nss.cc
+++ b/chrome/common/net/x509_certificate_model_nss.cc

@@ -191,13 +191,7 @@
 bool GetTimes(CERTCertificate* cert_handle,
               base::Time* issued,
               base::Time* expires) {
-  PRTime pr_issued, pr_expires;
-  if (CERT_GetCertTimes(cert_handle, &pr_issued, &pr_expires) == SECSuccess) {
-    *issued = crypto::PRTimeToBaseTime(pr_issued);
-    *expires = crypto::PRTimeToBaseTime(pr_expires);
-    return true;
-  }
-  return false;
+  return net::x509_util::GetValidityTimes(cert_handle, issued, expires);
 }
 
 string GetTitle(CERTCertificate* cert_handle) {
@@ -243,7 +237,7 @@
   return HashCert(cert_handle, HASH_AlgSHA1, SHA1_LENGTH);
 }
 
-string GetCMSString(const std::vector<CERTCertificate*>& cert_chain,
+string GetCMSString(const net::ScopedCERTCertificateList& cert_chain,
                     size_t start,
                     size_t end) {
   crypto::ScopedPLArenaPool arena(PORT_NewArena(1024));
@@ -254,15 +248,15 @@
 
   // First, create SignedData with the certificate only (no chain).
   ScopedNSSCMSSignedData signed_data(NSS_CMSSignedData_CreateCertsOnly(
-      message.get(), cert_chain[start], PR_FALSE));
+      message.get(), cert_chain[start].get(), PR_FALSE));
   if (!signed_data.get()) {
     DLOG(ERROR) << "NSS_CMSSignedData_Create failed";
     return std::string();
   }
   // Add the rest of the chain (if any).
   for (size_t i = start + 1; i < end; ++i) {
-    if (NSS_CMSSignedData_AddCertificate(signed_data.get(), cert_chain[i]) !=
-        SECSuccess) {
+    if (NSS_CMSSignedData_AddCertificate(signed_data.get(),
+                                         cert_chain[i].get()) != SECSuccess) {
       DLOG(ERROR) << "NSS_CMSSignedData_AddCertificate failed on " << i;
       return std::string();
     }

diff --git a/chrome/common/net/x509_certificate_model_nss.h b/chrome/common/net/x509_certificate_model_nss.h
index 80a1905f..e0c9b1e 100644
--- a/chrome/common/net/x509_certificate_model_nss.h
+++ b/chrome/common/net/x509_certificate_model_nss.h

@@ -83,7 +83,7 @@
 std::string HashCertSHA256(CERTCertificate* cert_handle);
 std::string HashCertSHA1(CERTCertificate* cert_handle);
 
-std::string GetCMSString(const std::vector<CERTCertificate*>& cert_chain,
+std::string GetCMSString(const net::ScopedCERTCertificateList& cert_chain,
                          size_t start,
                          size_t end);
 

diff --git a/chrome/common/net/x509_certificate_model_nss_unittest.cc b/chrome/common/net/x509_certificate_model_nss_unittest.cc
index db36323..3bc0cc8 100644
--- a/chrome/common/net/x509_certificate_model_nss_unittest.cc
+++ b/chrome/common/net/x509_certificate_model_nss_unittest.cc

@@ -263,14 +263,11 @@
   net::ScopedCERTCertificateList certs = CreateCERTCertificateListFromFile(
       net::GetTestCertsDirectory(), "multi-root-chain1.pem",
       net::X509Certificate::FORMAT_AUTO);
-  std::vector<CERTCertificate*> certs_raw;
-  for (const auto& cert : certs)
-    certs_raw.push_back(cert.get());
 
   {
     // Write the full chain.
     std::string pkcs7_string =
-        x509_certificate_model::GetCMSString(certs_raw, 0, certs_raw.size());
+        x509_certificate_model::GetCMSString(certs, 0, certs.size());
 
     ASSERT_FALSE(pkcs7_string.empty());
 
@@ -292,7 +289,7 @@
   {
     // Write only the first cert.
     std::string pkcs7_string =
-        x509_certificate_model::GetCMSString(certs_raw, 0, 1);
+        x509_certificate_model::GetCMSString(certs, 0, 1);
 
     net::ScopedCERTCertificateList decoded_certs =
         net::x509_util::CreateCERTCertificateListFromBytes(

diff --git a/chrome/common/url_constants.cc b/chrome/common/url_constants.cc
index 8a3f7529..2e7c3c2f 100644
--- a/chrome/common/url_constants.cc
+++ b/chrome/common/url_constants.cc

@@ -90,6 +90,7 @@
 const char kChromeUISupervisedUserPassphrasePageURL[] =
     "chrome://managed-user-passphrase/";
 const char kChromeUISyncConfirmationURL[] = "chrome://sync-confirmation/";
+const char kChromeUISysInternalsURL[] = "chrome://sys-internals/";
 const char kChromeUITermsURL[] = "chrome://terms/";
 const char kChromeUIThemeURL[] = "chrome://theme/";
 const char kChromeUIThumbnailURL[] = "chrome://thumb/";
@@ -250,6 +251,7 @@
 const char kChromeUISyncFileSystemInternalsHost[] = "syncfs-internals";
 const char kChromeUISyncInternalsHost[] = "sync-internals";
 const char kChromeUISyncResourcesHost[] = "syncresources";
+const char kChromeUISysInternalsHost[] = "sys-internals";
 const char kChromeUISystemInfoHost[] = "system";
 const char kChromeUITaskSchedulerInternalsHost[] = "taskscheduler-internals";
 const char kChromeUITermsHost[] = "terms";

diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
index 071ccfab..c1a55a2 100644
--- a/chrome/common/url_constants.h
+++ b/chrome/common/url_constants.h

@@ -84,6 +84,7 @@
 extern const char kChromeUISuggestionsURL[];
 extern const char kChromeUISupervisedUserPassphrasePageURL[];
 extern const char kChromeUISyncConfirmationURL[];
+extern const char kChromeUISysInternalsURL[];
 extern const char kChromeUITermsURL[];
 extern const char kChromeUIThemeURL[];
 extern const char kChromeUIThumbnailURL[];
@@ -234,6 +235,7 @@
 extern const char kChromeUISyncFileSystemInternalsHost[];
 extern const char kChromeUISyncInternalsHost[];
 extern const char kChromeUISyncResourcesHost[];
+extern const char kChromeUISysInternalsHost[];
 extern const char kChromeUISystemInfoHost[];
 extern const char kChromeUITaskSchedulerInternalsHost[];
 extern const char kChromeUITermsHost[];

diff --git a/chrome/installer/linux/BUILD.gn b/chrome/installer/linux/BUILD.gn
index 927b1b2..c45ccde 100644
--- a/chrome/installer/linux/BUILD.gn
+++ b/chrome/installer/linux/BUILD.gn

@@ -17,6 +17,63 @@
 
 assert(is_linux)
 
+packaging_files_binaries = [
+  "$root_out_dir/chrome",
+  "$root_out_dir/chrome_sandbox",
+]
+
+if (enable_nacl) {
+  packaging_files_binaries += [
+    "$root_out_dir/nacl_helper",
+    "$root_out_dir/nacl_helper_bootstrap",
+  ]
+
+  if (current_cpu == "x86") {
+    packaging_files_binaries += [ "$root_out_dir/nacl_irt_x86_32.nexe" ]
+  } else if (current_cpu == "x64") {
+    packaging_files_binaries += [ "$root_out_dir/nacl_irt_x86_64.nexe" ]
+  } else if (current_cpu == "arm") {
+    packaging_files_binaries += [ "$root_out_dir/nacl_irt_arm.nexe" ]
+  }
+}
+
+# The widevine BUILD.gn only produces shared libraries for x86 and x64
+if (is_chrome_branded && (current_cpu == "x86" || current_cpu == "x64")) {
+  packaging_files_binaries += [
+    "$root_out_dir/$widevine_cdm_path/libwidevinecdmadapter.so",
+    "$root_out_dir/$widevine_cdm_path/libwidevinecdm.so",
+  ]
+}
+
+if (!libcpp_is_static && use_custom_libcxx) {
+  packaging_files_binaries += [ "$root_out_dir/libc++.so" ]
+}
+
+# TODO(mmoss) Any convenient way to get all the relevant build files?
+# (e.g. all locales, resources, etc.)
+packaging_files = packaging_files_binaries + [
+                    "$root_out_dir/xdg-mime",
+                    "$root_out_dir/xdg-settings",
+                    "$root_out_dir/locales/en-US.pak",
+                  ]
+
+action_foreach("check_package_dependencies") {
+  deps = [
+    ":installer_deps",
+  ]
+  script = "debian/check-package-constraints-satisfied.py"
+  sources = packaging_files_binaries
+  outputs = [
+    "$root_out_dir/check_deps_{{source_name_part}}.stamp",
+  ]
+  args = [
+    "{{source}}",
+    rebase_path(sysroot, root_build_dir),
+    target_cpu,
+    "check_deps_{{source_name_part}}.stamp",
+  ]
+}
+
 # This target builds all "normal" Linux installers.
 #
 # The bot setup is to build stable, unstable, and beta packages for the current
@@ -209,39 +266,6 @@
     build_script_arch = current_cpu
   }
 
-  packaging_files_binaries = [
-    # TODO(mmoss) Any convenient way to get all the relevant build
-    # files? (e.g. all locales, resources, etc.)
-    "$root_out_dir/chrome",
-    "$root_out_dir/chrome_sandbox",
-    "$root_out_dir/xdg-mime",
-    "$root_out_dir/xdg-settings",
-    "$root_out_dir/locales/en-US.pak",
-
-    "$root_out_dir/nacl_helper",
-    "$root_out_dir/nacl_helper_bootstrap",
-  ]
-
-  if (current_cpu == "x86") {
-    packaging_files_binaries += [ "$root_out_dir/nacl_irt_x86_32.nexe" ]
-  } else if (current_cpu == "x64") {
-    packaging_files_binaries += [ "$root_out_dir/nacl_irt_x86_64.nexe" ]
-  } else if (current_cpu == "arm") {
-    packaging_files_binaries += [ "$root_out_dir/nacl_irt_arm.nexe" ]
-  }
-
-  # The widevine BUILD.gn only produces shared libraries for x86 and x64
-  if (is_chrome_branded && (current_cpu == "x86" || current_cpu == "x64")) {
-    packaging_files_binaries += [
-      "$root_out_dir/$widevine_cdm_path/libwidevinecdmadapter.so",
-      "$root_out_dir/$widevine_cdm_path/libwidevinecdm.so",
-    ]
-  }
-
-  if (!libcpp_is_static && use_custom_libcxx) {
-    packaging_files_binaries += [ "$root_out_dir/libc++.so" ]
-  }
-
   deb_target_name = "${target_name}_deb"
   action(deb_target_name) {
     visibility = [ ":*" ]
@@ -257,7 +281,7 @@
       assert(false, "Linux installer not configured for this architecture.")
     }
 
-    inputs = packaging_files_binaries
+    inputs = packaging_files
     outputs = [
       "$root_out_dir/google-chrome-${channel}_${chrome_version_full}-1_${deb_arch}.deb",
     ]
@@ -302,7 +326,7 @@
         assert(false, "Linux installer not configured for this architecture.")
       }
 
-      inputs = packaging_files_binaries
+      inputs = packaging_files
       outputs = [
         "$root_out_dir/google-chrome-${channel}-${chrome_version_full}-1.${rpm_arch}.rpm",
       ]

diff --git a/chrome/installer/linux/debian/check-package-constraints-satisfied.py b/chrome/installer/linux/debian/check-package-constraints-satisfied.py
index 7aa379a2..8141ed8 100755
--- a/chrome/installer/linux/debian/check-package-constraints-satisfied.py
+++ b/chrome/installer/linux/debian/check-package-constraints-satisfied.py

@@ -15,21 +15,24 @@
 
 import deb_version
 
-if len(sys.argv) != 4:
-  print 'Usage: %s /path/to/binary /path/to/sysroot arch' % sys.argv[0]
+if len(sys.argv) != 5:
+  print 'Usage: %s binary_path sysroot_path arch stamp_path' % sys.argv[0]
   sys.exit(1)
-
 binary = os.path.abspath(sys.argv[1])
 sysroot = os.path.abspath(sys.argv[2])
 arch = sys.argv[3]
+stamp = sys.argv[4]
 
 cmd = ['dpkg-shlibdeps']
-if arch == 'amd64':
+if arch == 'x64':
   cmd.extend(['-l%s/usr/lib/x86_64-linux-gnu' % sysroot,
               '-l%s/lib/x86_64-linux-gnu' % sysroot])
-elif arch == 'i386':
+elif arch == 'x86':
   cmd.extend(['-l%s/usr/lib/i386-linux-gnu' % sysroot,
               '-l%s/lib/i386-linux-gnu' % sysroot])
+elif arch == 'arm':
+  cmd.extend(['-l%s/usr/lib/arm-linux-gnueabihf' % sysroot,
+              '-l%s/lib/arm-linux-gnueabihf' % sysroot])
 else:
   print 'Unsupported architecture ' + arch
   sys.exit(1)
@@ -74,11 +77,13 @@
          'not implemented at this time.')
   sys.exit(1)
 
-deps = stdout.replace('shlibs:Depends=', '').replace('\n', '').split(', ')
+deps_str = stdout.replace('shlibs:Depends=', '').replace('\n', '')
+deps = deps_str.split(', ')
 package_requirements = {}
-for dep in deps:
-  (package, requirement) = get_package_and_version_requirement(dep)
-  package_requirements[package] = requirement
+if deps_str != '':
+  for dep in deps:
+    (package, requirement) = get_package_and_version_requirement(dep)
+    package_requirements[package] = requirement
 
 script_dir = os.path.dirname(os.path.abspath(__file__))
 deps_file = os.path.join(script_dir, 'dist-package-versions.json')
@@ -99,4 +104,7 @@
       print >> sys.stderr, 'Dependency on package %s not satisfiable on %s' % (
           package, distro)
       ret_code = 1
+if ret_code == 0:
+  with open(stamp, 'a'):
+    os.utime(stamp, None)
 exit(ret_code)

diff --git a/chrome/profiling/address.h b/chrome/profiling/address.h
index e9ffda3..9a78e1d 100644
--- a/chrome/profiling/address.h
+++ b/chrome/profiling/address.h

@@ -56,7 +56,7 @@
   typedef profiling::Address argument_type;
   typedef uint32_t result_type;
   result_type operator()(argument_type a) const {
-    return base::Hash(reinterpret_cast<char*>(&a.value), sizeof(int64_t));
+    return base::Hash(&a.value, sizeof(int64_t));
   }
 };
 

diff --git a/chrome/profiling/backtrace.cc b/chrome/profiling/backtrace.cc
index c14cc38..406f6a4 100644
--- a/chrome/profiling/backtrace.cc
+++ b/chrome/profiling/backtrace.cc

@@ -20,8 +20,7 @@
   if (addrs.empty())
     return 0;
   // Assume Address is a POD containing only the address with no padding.
-  return base::Hash(reinterpret_cast<const char*>(&addrs[0]),
-                    addrs.size() * sizeof(Address));
+  return base::Hash(addrs.data(), addrs.size() * sizeof(Address));
 }
 
 }  // namespace

diff --git a/chrome/profiling/memlog_stream_parser.cc b/chrome/profiling/memlog_stream_parser.cc
index 6186444..33f810450 100644
--- a/chrome/profiling/memlog_stream_parser.cc
+++ b/chrome/profiling/memlog_stream_parser.cc

@@ -23,7 +23,9 @@
 MemlogStreamParser::Block::Block(std::unique_ptr<char[]> d, size_t s)
     : data(std::move(d)), size(s) {}
 
-MemlogStreamParser::Block::~Block() {}
+MemlogStreamParser::Block::Block(Block&& other) noexcept = default;
+
+MemlogStreamParser::Block::~Block() = default;
 
 MemlogStreamParser::MemlogStreamParser(MemlogReceiver* receiver)
     : receiver_(receiver) {}

diff --git a/chrome/profiling/memlog_stream_parser.h b/chrome/profiling/memlog_stream_parser.h
index daec92b..88c6dc01 100644
--- a/chrome/profiling/memlog_stream_parser.h
+++ b/chrome/profiling/memlog_stream_parser.h

@@ -5,8 +5,7 @@
 #ifndef CHROME_PROFILING_MEMLOG_STREAM_PARSER_H_
 #define CHROME_PROFILING_MEMLOG_STREAM_PARSER_H_
 
-#include <deque>
-
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/synchronization/lock.h"
 #include "chrome/profiling/memlog_receiver.h"
@@ -36,6 +35,7 @@
  private:
   struct Block {
     Block(std::unique_ptr<char[]> d, size_t s);
+    Block(Block&& other) noexcept;
     ~Block();
 
     std::unique_ptr<char[]> data;
@@ -68,7 +68,7 @@
   // Not owned by this class.
   MemlogReceiver* receiver_;
 
-  std::deque<Block> blocks_;
+  base::circular_deque<Block> blocks_;
 
   bool received_header_ = false;
   bool error_ = false;

diff --git a/chrome/renderer/autofill/password_autofill_agent_browsertest.cc b/chrome/renderer/autofill/password_autofill_agent_browsertest.cc
index bcfa1562..fa201ddd 100644
--- a/chrome/renderer/autofill/password_autofill_agent_browsertest.cc
+++ b/chrome/renderer/autofill/password_autofill_agent_browsertest.cc

@@ -358,9 +358,9 @@
         password_manager::features::kFillOnAccountSelect);
   }
 
-  void SetManualFallbacks() {
+  void SetManualFallbacksStandalone() {
     scoped_feature_list_.InitAndEnableFeature(
-        password_manager::features::kEnableManualFallbacksFilling);
+        password_manager::features::kEnableManualFallbacksFillingStandalone);
   }
 
   void EnableShowAutofillSignatures() {
@@ -3146,7 +3146,7 @@
 
 // Tests that "Show all saved passwords" option is shown on a password field.
 TEST_F(PasswordAutofillAgentTest, ShowAllSavedPasswordsTest) {
-  SetManualFallbacks();
+  SetManualFallbacksStandalone();
   LoadHTML(kFormHTML);
   SetFocused(username_element_);
   SimulateElementClick("username");
@@ -3160,7 +3160,7 @@
 // field.
 TEST_F(PasswordAutofillAgentTest,
        NotShowAllSavedPasswordsOnCreditCardFormTest) {
-  SetManualFallbacks();
+  SetManualFallbacksStandalone();
   LoadHTML(kCreditCardFormHTML);
   SetFocused(username_element_);
   SimulateElementClick("username");
@@ -3171,7 +3171,7 @@
 }
 
 TEST_F(PasswordAutofillAgentTest, NotShowShowAllSavedPasswordsTest) {
-  SetManualFallbacks();
+  SetManualFallbacksStandalone();
   LoadHTML(kFormHTML);
   SetFocused(password_element_);
   SimulateElementClick("password");
@@ -3183,7 +3183,7 @@
 }
 
 TEST_F(PasswordAutofillAgentTest, NotShowShowAllSavedPasswordsTestBlacklisted) {
-  SetManualFallbacks();
+  SetManualFallbacksStandalone();
   LoadHTML(kFormHTML);
   password_autofill_agent_->BlacklistedFormFound();
   SetFocused(password_element_);

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 03ecd2f2..e68c16c 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -3972,6 +3972,7 @@
       "../browser/extensions/api/activity_log_private/activity_log_private_api_unittest.cc",
       "../browser/extensions/api/bookmark_manager_private/bookmark_manager_private_api_unittest.cc",
       "../browser/extensions/api/bookmarks/bookmark_api_helpers_unittest.cc",
+      "../browser/extensions/api/chrome_extensions_api_client_unittest.cc",
       "../browser/extensions/api/content_settings/content_settings_store_unittest.cc",
       "../browser/extensions/api/content_settings/content_settings_unittest.cc",
       "../browser/extensions/api/cookies/cookies_unittest.cc",
@@ -4257,6 +4258,7 @@
       "//extensions/browser:test_support",
       "//extensions/common",
       "//extensions/strings",
+      "//google_apis",
       "//media/cast:test_support",
 
       # This will add all of the unit tests for the schema compiler to this

diff --git a/chrome/test/chromedriver/logging.h b/chrome/test/chromedriver/logging.h
index e9b936b..3f582ab 100644
--- a/chrome/test/chromedriver/logging.h
+++ b/chrome/test/chromedriver/logging.h

@@ -5,11 +5,11 @@
 #ifndef CHROME_TEST_CHROMEDRIVER_LOGGING_H_
 #define CHROME_TEST_CHROMEDRIVER_LOGGING_H_
 
-#include <deque>
 #include <memory>
 #include <string>
 #include <vector>
 
+#include "base/containers/circular_deque.h"
 #include "base/macros.h"
 #include "base/values.h"
 #include "chrome/test/chromedriver/chrome/log.h"
@@ -74,7 +74,7 @@
   // A queue of batches of entries. Each batch can have no more than
   // |kMaxReturnedEntries| values in it. This is to avoid HTTP response buffer
   // overflow (crbug.com/681892).
-  std::deque<std::unique_ptr<base::ListValue>> batches_of_entries_;
+  base::circular_deque<std::unique_ptr<base::ListValue>> batches_of_entries_;
 
   DISALLOW_COPY_AND_ASSIGN(WebDriverLog);
 };

diff --git a/chrome/test/chromedriver/session.cc b/chrome/test/chromedriver/session.cc
index 4aaaca7c..9518046 100644
--- a/chrome/test/chromedriver/session.cc
+++ b/chrome/test/chromedriver/session.cc

@@ -42,6 +42,7 @@
       force_devtools_screenshot(false),
       sticky_modifiers(0),
       mouse_position(0, 0),
+      pressed_mouse_button(kNoneMouseButton),
       page_load_timeout(kDefaultPageLoadTimeout),
       script_timeout(kDefaultScriptTimeout),
       auto_reporting_enabled(false) {}
@@ -55,6 +56,7 @@
       chrome(std::move(chrome)),
       sticky_modifiers(0),
       mouse_position(0, 0),
+      pressed_mouse_button(kNoneMouseButton),
       page_load_timeout(kDefaultPageLoadTimeout),
       script_timeout(kDefaultScriptTimeout),
       auto_reporting_enabled(false) {}

diff --git a/chrome/test/chromedriver/session.h b/chrome/test/chromedriver/session.h
index 6c4fd0a..da05fe632 100644
--- a/chrome/test/chromedriver/session.h
+++ b/chrome/test/chromedriver/session.h

@@ -16,6 +16,7 @@
 #include "chrome/test/chromedriver/chrome/geoposition.h"
 #include "chrome/test/chromedriver/chrome/network_conditions.h"
 #include "chrome/test/chromedriver/chrome/scoped_temp_dir_with_retry.h"
+#include "chrome/test/chromedriver/chrome/ui_events.h"
 #include "chrome/test/chromedriver/command_listener.h"
 
 static const char kAccept[] = "accept";
@@ -72,6 +73,7 @@
   // this list will be empty.
   std::list<FrameInfo> frames;
   WebPoint mouse_position;
+  MouseButton pressed_mouse_button;
   base::TimeDelta implicit_wait;
   base::TimeDelta page_load_timeout;
   base::TimeDelta script_timeout;

diff --git a/chrome/test/chromedriver/window_commands.cc b/chrome/test/chromedriver/window_commands.cc
index e832b5c..c851bf0 100644
--- a/chrome/test/chromedriver/window_commands.cc
+++ b/chrome/test/chromedriver/window_commands.cc

@@ -582,7 +582,7 @@
 
   std::list<MouseEvent> events;
   events.push_back(
-      MouseEvent(kMovedMouseEventType, kNoneMouseButton,
+      MouseEvent(kMovedMouseEventType, session->pressed_mouse_button,
                  location.x, location.y, session->sticky_modifiers, 0));
   Status status =
       web_view->DispatchMouseEvents(events, session->GetCurrentFrameId());
@@ -609,6 +609,7 @@
       MouseEvent(kReleasedMouseEventType, button,
                  session->mouse_position.x, session->mouse_position.y,
                  session->sticky_modifiers, 1));
+  session->pressed_mouse_button = kNoneMouseButton;
   return web_view->DispatchMouseEvents(events, session->GetCurrentFrameId());
 }
 
@@ -626,6 +627,7 @@
       MouseEvent(kPressedMouseEventType, button,
                  session->mouse_position.x, session->mouse_position.y,
                  session->sticky_modifiers, 1));
+  session->pressed_mouse_button = button;
   return web_view->DispatchMouseEvents(events, session->GetCurrentFrameId());
 }
 
@@ -643,6 +645,7 @@
       MouseEvent(kReleasedMouseEventType, button,
                  session->mouse_position.x, session->mouse_position.y,
                  session->sticky_modifiers, 1));
+  session->pressed_mouse_button = kNoneMouseButton;
   return web_view->DispatchMouseEvents(events, session->GetCurrentFrameId());
 }
 
@@ -664,6 +667,7 @@
       MouseEvent(kReleasedMouseEventType, button,
                  session->mouse_position.x, session->mouse_position.y,
                  session->sticky_modifiers, 2));
+  session->pressed_mouse_button = kNoneMouseButton;
   return web_view->DispatchMouseEvents(events, session->GetCurrentFrameId());
 }
 

diff --git a/chrome/test/data/extensions/api_test/webrequest_dice_header/background.js b/chrome/test/data/extensions/api_test/webrequest_dice_header/background.js
new file mode 100644
index 0000000..3366083
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/webrequest_dice_header/background.js

@@ -0,0 +1,33 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+window.diceResponseHeaderCount = 0;
+window.controlResponseHeaderCount = 0;
+
+chrome.webRequest.onHeadersReceived.addListener(function(details) {
+  let diceHeaderFound = false;
+  const headerValue = 'ValueFromExtension'
+  const diceResponseHeader = 'X-Chrome-ID-Consistency-Response';
+  details.responseHeaders.forEach(function(header) {
+    if (header.name == diceResponseHeader){
+      ++window.diceResponseHeaderCount;
+      diceHeaderFound = true;
+      header.value = headerValue;
+    } else if (header.name == 'X-Control'){
+      ++window.controlResponseHeaderCount;
+      header.value = headerValue;
+    }
+  });
+  if (!diceHeaderFound) {
+    details.responseHeaders.push({name: diceResponseHeader,
+                                  value: headerValue});
+  }
+  details.responseHeaders.push({name: 'X-New-Header',
+                                value: headerValue});
+  return {responseHeaders: details.responseHeaders};
+},
+{urls: ['http://*/extensions/dice.html']},
+['blocking', 'responseHeaders']);
+
+chrome.test.sendMessage('ready');

diff --git a/chrome/test/data/extensions/api_test/webrequest_dice_header/manifest.json b/chrome/test/data/extensions/api_test/webrequest_dice_header/manifest.json
new file mode 100644
index 0000000..380aa9d
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/webrequest_dice_header/manifest.json

@@ -0,0 +1,8 @@
+{
+  "name": "Reads and writes the Dice response header",
+  "description": "Reads and writes the Dice response header",
+  "manifest_version": 2,
+  "permissions": ["webRequest", "webRequestBlocking", "<all_urls>"],
+  "version": "0.1",
+  "background": {"scripts": ["background.js"]}
+}

diff --git a/chrome/test/data/extensions/dice.html b/chrome/test/data/extensions/dice.html
new file mode 100644
index 0000000..3558a5f
--- /dev/null
+++ b/chrome/test/data/extensions/dice.html

@@ -0,0 +1,3 @@
+<html>
+<body>dice test</body>
+</html>

diff --git a/chrome/test/data/extensions/dice.html.mock-http-headers b/chrome/test/data/extensions/dice.html.mock-http-headers
new file mode 100644
index 0000000..23c7a46
--- /dev/null
+++ b/chrome/test/data/extensions/dice.html.mock-http-headers

@@ -0,0 +1,5 @@
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: -1
+X-Control: ValueFromServer
+X-Chrome-ID-Consistency-Response: ValueFromServer

diff --git a/chrome/test/data/webui/BUILD.gn b/chrome/test/data/webui/BUILD.gn
index 15d83cd..c382ce4 100644
--- a/chrome/test/data/webui/BUILD.gn
+++ b/chrome/test/data/webui/BUILD.gn

@@ -105,7 +105,10 @@
   ]
 
   if (is_chromeos) {
-    sources += [ "settings/easy_unlock_browsertest_chromeos.js" ]
+    sources += [
+      "settings/easy_unlock_browsertest_chromeos.js",
+      "sys_internals/sys_internals_browsertest.js",
+    ]
   }
 
   if (is_chrome_branded) {

diff --git a/chrome/test/data/webui/certificate_viewer_ui_test-inl.h b/chrome/test/data/webui/certificate_viewer_ui_test-inl.h
index 684b8838..705749f 100644
--- a/chrome/test/data/webui/certificate_viewer_ui_test-inl.h
+++ b/chrome/test/data/webui/certificate_viewer_ui_test-inl.h

@@ -16,7 +16,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
 #include "content/public/test/browser_test_utils.h"
-#include "net/cert/x509_certificate.h"
+#include "net/cert/x509_util_nss.h"
 #include "net/test/test_certificate_data.h"
 
 // Test framework for chrome/test/data/webui/certificate_viewer_dialog_test.js.
@@ -39,16 +39,18 @@
 }
 
 void CertificateViewerUITest::ShowCertificateViewer() {
-  scoped_refptr<net::X509Certificate> google_cert(
-      net::X509Certificate::CreateFromBytes(
-          reinterpret_cast<const char*>(google_der), sizeof(google_der)));
+  net::ScopedCERTCertificate google_cert(
+      net::x509_util::CreateCERTCertificateFromBytes(google_der,
+                                                     sizeof(google_der)));
   ASSERT_TRUE(google_cert);
+  net::ScopedCERTCertificateList certs;
+  certs.push_back(net::x509_util::DupCERTCertificate(google_cert.get()));
 
   ASSERT_TRUE(browser());
   ASSERT_TRUE(browser()->window());
 
   CertificateViewerDialog* dialog =
-      new CertificateViewerDialog(google_cert.get());
+      new CertificateViewerDialog(std::move(certs));
   dialog->Show(browser()->tab_strip_model()->GetActiveWebContents(),
                browser()->window()->GetNativeWindow());
   content::WebContents* webui_webcontents =
@@ -62,16 +64,18 @@
 
 #if defined(OS_CHROMEOS)
 void CertificateViewerUITest::ShowModalCertificateViewer() {
-  scoped_refptr<net::X509Certificate> google_cert(
-      net::X509Certificate::CreateFromBytes(
-          reinterpret_cast<const char*>(google_der), sizeof(google_der)));
+  net::ScopedCERTCertificate google_cert(
+      net::x509_util::CreateCERTCertificateFromBytes(google_der,
+                                                     sizeof(google_der)));
   ASSERT_TRUE(google_cert);
+  net::ScopedCERTCertificateList certs;
+  certs.push_back(net::x509_util::DupCERTCertificate(google_cert.get()));
 
   ASSERT_TRUE(browser());
   ASSERT_TRUE(browser()->window());
 
   CertificateViewerModalDialog* dialog =
-      new CertificateViewerModalDialog(google_cert.get());
+      new CertificateViewerModalDialog(std::move(certs));
   dialog->Show(browser()->tab_strip_model()->GetActiveWebContents(),
                browser()->window()->GetNativeWindow());
   content::WebContents* webui_webcontents =

diff --git a/chrome/test/data/webui/settings/bluetooth_page_tests.js b/chrome/test/data/webui/settings/bluetooth_page_tests.js
index 5644558..5da95ac2 100644
--- a/chrome/test/data/webui/settings/bluetooth_page_tests.js
+++ b/chrome/test/data/webui/settings/bluetooth_page_tests.js

@@ -2,6 +2,22 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+function getFakePrefs() {
+  return {
+    ash: {
+      user: {
+        bluetooth: {
+          adapter_enabled: {
+            key: 'ash.user.bluetooth.adapter_enabled',
+            type: chrome.settingsPrivate.PrefType.BOOLEAN,
+            value: false,
+          }
+        }
+      }
+    }
+  };
+}
+
 suite('Bluetooth', function() {
   var bluetoothPage = null;
 
@@ -60,6 +76,7 @@
   setup(function() {
     PolymerTest.clearBody();
     bluetoothPage = document.createElement('settings-bluetooth-page');
+    bluetoothPage.prefs = getFakePrefs();
     assertTrue(!!bluetoothPage);
 
     bluetoothApi_.setDevicesForTest([]);

diff --git a/chrome/test/data/webui/sys_internals/sys_internals_browsertest.js b/chrome/test/data/webui/sys_internals/sys_internals_browsertest.js
new file mode 100644
index 0000000..a4dadb6
--- /dev/null
+++ b/chrome/test/data/webui/sys_internals/sys_internals_browsertest.js

@@ -0,0 +1,102 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview Test suite for the SysInternals WebUI. (CrOS only)
+ */
+const ROOT_PATH = '../../../../../';
+
+function SysInternalsBrowserTest() {}
+
+SysInternalsBrowserTest.prototype = {
+  __proto__: testing.Test.prototype,
+
+  browsePreload: 'chrome://sys-internals',
+
+  runAccessibilityChecks: false,
+
+  isAsync: true,
+
+  commandLineSwitches:
+      [{switchName: 'enable-features', switchValue: 'SysInternals'}],
+
+  extraLibraries: [
+    ROOT_PATH + 'third_party/mocha/mocha.js',
+    ROOT_PATH + 'chrome/test/data/webui/mocha_adapter.js',
+  ],
+
+  /** @override */
+  setUp: function() {
+    testing.Test.prototype.setUp.call(this);
+  },
+};
+
+// TODO : move this test into its own file.
+TEST_F('SysInternalsBrowserTest', 'getSysInfo', function() {
+  test('message handler integration test', function(done) {
+    function checkConst(constVal) {
+      if (!Number.isInteger(constVal.counterMax)) {
+        throw `result.const.counterMax is invalid : ${counterMax}`;
+      }
+    }
+
+    function isCounter(number) {
+      return Number.isInteger(number) && number >= 0;
+    }
+
+    function checkCpu(cpu) {
+      return isCounter(cpu.user) && isCounter(cpu.kernel) &&
+          isCounter(cpu.idle) && isCounter(cpu.total);
+    }
+
+    function checkCpus(cpus) {
+      if (!Array.isArray(cpus)) {
+        throw 'result.cpus is not an Array.';
+        return;
+      }
+      for (let i = 0; i < cpus.length; ++i) {
+        if (!checkCpu(cpus[i])) {
+          throw `result.cpus[${i}] : ${JSON.stringify(cpus[i])}`;
+        }
+      }
+    }
+
+    function isMemoryByte(number) {
+      return typeof number === 'number' && number >= 0;
+    }
+
+    function checkMemory(memory) {
+      if (!memory || typeof memory !== 'object' ||
+          !isMemoryByte(memory.available) || !isMemoryByte(memory.total) ||
+          !isMemoryByte(memory.swapFree) || !isMemoryByte(memory.swapTotal) ||
+          !isCounter(memory.pswpin) || !isCounter(memory.pswpout)) {
+        throw `result.memory is invalid : ${JSON.stringify(memory)}`;
+      }
+    }
+
+    function checkZram(zram) {
+      if (!zram || typeof zram !== 'object' ||
+          !isMemoryByte(zram.comprDataSize) ||
+          !isMemoryByte(zram.origDataSize) ||
+          !isMemoryByte(zram.memUsedTotal) || !isCounter(zram.numReads) ||
+          !isCounter(zram.numWrites)) {
+        throw `result.zram is invalid : ${JSON.stringify(zram)}`;
+      }
+    }
+
+    cr.sendWithPromise('getSysInfo').then(function(result) {
+      try {
+        checkConst(result.const);
+        checkCpus(result.cpus);
+        checkMemory(result.memory);
+        checkZram(result.zram);
+        done();
+      } catch (err) {
+        done(new Error(err));
+      }
+    });
+  });
+
+  mocha.run();
+});

diff --git a/chrome_elf/chrome_elf_x64.def b/chrome_elf/chrome_elf_x64.def
index 184b7989..2043beb 100644
--- a/chrome_elf/chrome_elf_x64.def
+++ b/chrome_elf/chrome_elf_x64.def

@@ -7,21 +7,27 @@
   ; When functions are added to this file, they must also be added to
   ; chrome_elf_x86.def
 
-  ; From components/crash/content/app/crashpad.cc
-  ClearCrashKeyValueImpl
-  ClearCrashKeyValueImplEx
-  RequestSingleCrashUploadImpl
-  SetCrashKeyValueImpl
-  SetCrashKeyValueImplEx
-  SetUploadConsentImpl
+  ; From components/crash/content/app/crash_export_stubs.cc
+  ClearCrashKeyValueEx_ExportThunk
+  ClearCrashKeyValue_ExportThunk
+  CrashForException_ExportThunk
+  GetCrashReports_ExportThunk
+  InjectDumpForHungInputNoCrashKeys_ExportThunk
+  InjectDumpForHungInput_ExportThunk
+  RequestSingleCrashUpload_ExportThunk
+  SetCrashKeyValueEx_ExportThunk
+  SetCrashKeyValue_ExportThunk
+  SetUploadConsent_ExportThunk
 
-  ; From components/crash/content/app/crashpad_win.cc
-  CrashForException
-  InjectDumpForHungInput
-  InjectDumpForHungInputNoCrashKeys
+  ; X64-only exports
+  RegisterNonABICompliantCodeRange_ExportThunk
+  UnregisterNonABICompliantCodeRange_ExportThunk
+
+  ; This export is used by SyzyASAN, do not rename or remove without talking
+  ; to syzygy-team@chromium.org first.
+  SetCrashKeyValue = SetCrashKeyValue_ExportThunk
 
   ; From chrome_elf/crash_helper.cc
-  GetCrashReportsImpl
   SetMetricsClientId
 
   ; From chrome_elf_main.cc
@@ -38,8 +44,3 @@
   GetBlacklistIndex
   IsBlacklistInitialized
   SuccessfullyBlocked
-
-  ; X64-only exports
-  ; From components/crash/content/app/crashpad_win.cc
-  RegisterNonABICompliantCodeRange
-  UnregisterNonABICompliantCodeRange

diff --git a/chrome_elf/chrome_elf_x86.def b/chrome_elf/chrome_elf_x86.def
index d49b5e5..143c30d8 100644
--- a/chrome_elf/chrome_elf_x86.def
+++ b/chrome_elf/chrome_elf_x86.def

@@ -1,28 +1,29 @@
 ; Copyright 2013 The Chromium Authors. All rights reserved.
 ; Use of this source code is governed by a BSD-style license that can be
 ; found in the LICENSE file.
-
 LIBRARY  "chrome_elf.dll"
 
 EXPORTS
   ; When functions are added to this file, they must also be added to
-  ; chrome_elf_x64.def
+  ; chrome_elf_x86.def
 
-  ; From components/crash/content/app/crashpad.cc
-  ClearCrashKeyValueImpl
-  ClearCrashKeyValueImplEx
-  RequestSingleCrashUploadImpl
-  SetCrashKeyValueImpl
-  SetCrashKeyValueImplEx
-  SetUploadConsentImpl
+  ; From components/crash/content/app/crash_export_stubs.cc
+  ClearCrashKeyValueEx_ExportThunk
+  ClearCrashKeyValue_ExportThunk
+  CrashForException_ExportThunk
+  GetCrashReports_ExportThunk
+  InjectDumpForHungInputNoCrashKeys_ExportThunk
+  InjectDumpForHungInput_ExportThunk
+  RequestSingleCrashUpload_ExportThunk
+  SetCrashKeyValueEx_ExportThunk
+  SetCrashKeyValue_ExportThunk
+  SetUploadConsent_ExportThunk
 
-  ; From components/crash/content/app/crashpad_win.cc
-  CrashForException
-  InjectDumpForHungInput
-  InjectDumpForHungInputNoCrashKeys
+  ; This export is used by SyzyASAN, do not rename or remove without talking
+  ; to syzygy-team@chromium.org first.
+  SetCrashKeyValue = SetCrashKeyValue_ExportThunk
 
   ; From chrome_elf/crash_helper.cc
-  GetCrashReportsImpl
   SetMetricsClientId
 
   ; From chrome_elf_main.cc

diff --git a/chromecast/renderer/media/key_systems_cast.cc b/chromecast/renderer/media/key_systems_cast.cc
index 665a6aa..9cbdf891 100644
--- a/chromecast/renderer/media/key_systems_cast.cc
+++ b/chromecast/renderer/media/key_systems_cast.cc

@@ -30,38 +30,18 @@
 namespace media {
 namespace {
 
-#if defined(PLAYREADY_CDM_AVAILABLE) || \
-    (BUILDFLAG(IS_CAST_USING_CMA_BACKEND) && defined(WIDEVINE_CDM_AVAILABLE))
-SupportedCodecs GetCastEmeSupportedCodecs() {
-  SupportedCodecs codecs =
-      ::media::EME_CODEC_MP4_AAC | ::media::EME_CODEC_MP4_AVC1 |
-      ::media::EME_CODEC_COMMON_VP9 | ::media::EME_CODEC_WEBM_VP8 |
-      ::media::EME_CODEC_WEBM_VP9;
-
-#if BUILDFLAG(ENABLE_HEVC_DEMUXING)
-  codecs |= ::media::EME_CODEC_MP4_HEVC;
-#endif  // BUILDFLAG(ENABLE_HEVC_DEMUXING)
-
-#if BUILDFLAG(ENABLE_DOLBY_VISION_DEMUXING)
-  codecs |= ::media::EME_CODEC_MP4_DV_AVC;
-#if BUILDFLAG(ENABLE_HEVC_DEMUXING)
-  codecs |= ::media::EME_CODEC_MP4_DV_HEVC;
-#endif  // BUILDFLAG(ENABLE_HEVC_DEMUXING)
-#endif  // BUILDFLAG(ENABLE_DOLBY_VISION_DEMUXING)
-
-#if BUILDFLAG(ENABLE_AC3_EAC3_AUDIO_DEMUXING)
-  codecs |= ::media::EME_CODEC_MP4_AC3 | ::media::EME_CODEC_MP4_EAC3;
-#endif  // BUILDFLAG(ENABLE_AC3_EAC3_AUDIO_DEMUXING)
-
-  return codecs;
-}
-#endif  // defined(PLAYREADY_CDM_AVAILABLE) || ...
-
 #if defined(PLAYREADY_CDM_AVAILABLE)
 class PlayReadyKeySystemProperties : public ::media::KeySystemProperties {
  public:
-  explicit PlayReadyKeySystemProperties(bool persistent_license_support)
-      : persistent_license_support_(persistent_license_support) {}
+  PlayReadyKeySystemProperties(SupportedCodecs supported_non_secure_codecs,
+                               SupportedCodecs supported_secure_codecs,
+                               bool persistent_license_support)
+      : supported_non_secure_codecs_(supported_non_secure_codecs),
+#if defined(OS_ANDROID)
+        supported_secure_codecs_(supported_secure_codecs),
+#endif  // defined(OS_ANDROID)
+        persistent_license_support_(persistent_license_support) {
+  }
 
   std::string GetKeySystemName() const override {
     return media::kChromecastPlayreadyKeySystem;
@@ -72,9 +52,15 @@
   }
 
   SupportedCodecs GetSupportedCodecs() const override {
-    return GetCastEmeSupportedCodecs();
+    return supported_non_secure_codecs_;
   }
 
+#if defined(OS_ANDROID)
+  SupportedCodecs GetSupportedSecureCodecs() const override {
+    return supported_secure_codecs_;
+  }
+#endif  // defined(OS_ANDROID)
+
   EmeConfigRule GetRobustnessConfigRule(
       EmeMediaType media_type,
       const std::string& requested_robustness) const override {
@@ -83,7 +69,7 @@
       return EmeConfigRule::HW_SECURE_CODECS_REQUIRED;
 #else
       return EmeConfigRule::SUPPORTED;
-#endif
+#endif  // defined(OS_ANDROID)
     }
 
     // Cast-specific PlayReady implementation does not currently recognize or
@@ -109,36 +95,56 @@
   }
 
  private:
+  const SupportedCodecs supported_non_secure_codecs_;
+#if defined(OS_ANDROID)
+  const SupportedCodecs supported_secure_codecs_;
+#endif  // defined(OS_ANDROID)
   const bool persistent_license_support_;
 };
 #endif  // PLAYREADY_CDM_AVAILABLE
 
-}  // namespace
+#if BUILDFLAG(IS_CAST_USING_CMA_BACKEND)
+SupportedCodecs GetCastEmeSupportedCodecs() {
+  SupportedCodecs codecs =
+      ::media::EME_CODEC_MP4_AAC | ::media::EME_CODEC_MP4_AVC1 |
+      ::media::EME_CODEC_COMMON_VP9 | ::media::EME_CODEC_WEBM_VP8 |
+      ::media::EME_CODEC_WEBM_VP9;
 
-void AddChromecastKeySystems(
+#if BUILDFLAG(ENABLE_HEVC_DEMUXING)
+  codecs |= ::media::EME_CODEC_MP4_HEVC;
+#endif  // BUILDFLAG(ENABLE_HEVC_DEMUXING)
+
+#if BUILDFLAG(ENABLE_DOLBY_VISION_DEMUXING)
+  codecs |= ::media::EME_CODEC_MP4_DV_AVC;
+#if BUILDFLAG(ENABLE_HEVC_DEMUXING)
+  codecs |= ::media::EME_CODEC_MP4_DV_HEVC;
+#endif  // BUILDFLAG(ENABLE_HEVC_DEMUXING)
+#endif  // BUILDFLAG(ENABLE_DOLBY_VISION_DEMUXING)
+
+#if BUILDFLAG(ENABLE_AC3_EAC3_AUDIO_DEMUXING)
+  codecs |= ::media::EME_CODEC_MP4_AC3 | ::media::EME_CODEC_MP4_EAC3;
+#endif  // BUILDFLAG(ENABLE_AC3_EAC3_AUDIO_DEMUXING)
+
+  return codecs;
+}
+
+void AddCmaKeySystems(
     std::vector<std::unique_ptr<::media::KeySystemProperties>>*
         key_systems_properties,
-    bool enable_persistent_license_support,
-    bool force_software_crypto) {
+    bool enable_persistent_license_support) {
+  SupportedCodecs codecs = GetCastEmeSupportedCodecs();
+
+  // |codecs| may not be used if Widevine and Playready aren't supported.
+  ANALYZER_ALLOW_UNUSED(codecs);
+
 #if defined(PLAYREADY_CDM_AVAILABLE)
-  bool enable_persistent_license_playready = enable_persistent_license_support;
-#if defined(OS_ANDROID)
-  LOG_IF(WARNING, enable_persistent_license_playready)
-      << "Android doesn't support Playready persistent license.";
-  enable_persistent_license_playready = false;
-#endif
-  key_systems_properties->emplace_back(
-      new PlayReadyKeySystemProperties(enable_persistent_license_playready));
+  key_systems_properties->emplace_back(new PlayReadyKeySystemProperties(
+      codecs, codecs, enable_persistent_license_support));
 #endif  // defined(PLAYREADY_CDM_AVAILABLE)
 
 #if defined(WIDEVINE_CDM_AVAILABLE)
-#if defined(OS_ANDROID) && !BUILDFLAG(IS_CAST_USING_CMA_BACKEND)
-  cdm::AddAndroidWidevine(key_systems_properties);
-#else
   using Robustness = cdm::WidevineKeySystemProperties::Robustness;
 
-  SupportedCodecs codecs = GetCastEmeSupportedCodecs();
-
   key_systems_properties->emplace_back(new cdm::WidevineKeySystemProperties(
       codecs,                     // Regular codecs.
       Robustness::HW_SECURE_ALL,  // Max audio robustness.
@@ -150,9 +156,53 @@
       // Note: On Chromecast, all CDMs may have persistent state.
       EmeFeatureSupport::ALWAYS_ENABLED,    // Persistent state.
       EmeFeatureSupport::ALWAYS_ENABLED));  // Distinctive identifier.
-#endif  // defined(OS_ANDROID) && !BUILDFLAG(IS_CAST_USING_CMA_BACKEND)
 #endif  // defined(WIDEVINE_CDM_AVAILABLE)
 }
+#elif defined(OS_ANDROID)
+#if defined(PLAYREADY_CDM_AVAILABLE)
+void AddCastPlayreadyKeySystemAndroid(
+    std::vector<std::unique_ptr<::media::KeySystemProperties>>*
+        key_systems_properties) {
+  DCHECK(key_systems_properties);
+  SupportedKeySystemResponse response =
+      cdm::QueryKeySystemSupport(kChromecastPlayreadyKeySystem);
+
+  if (response.non_secure_codecs == ::media::EME_CODEC_NONE)
+    return;
+
+  key_systems_properties->emplace_back(new PlayReadyKeySystemProperties(
+      response.non_secure_codecs, response.secure_codecs,
+      false /* persistent_license_support */));
+}
+#endif  // defined(PLAYREADY_CDM_AVAILABLE)
+
+void AddCastAndroidKeySystems(
+    std::vector<std::unique_ptr<::media::KeySystemProperties>>*
+        key_systems_properties) {
+#if defined(PLAYREADY_CDM_AVAILABLE)
+  AddCastPlayreadyKeySystemAndroid(key_systems_properties);
+#endif  // defined(PLAYREADY_CDM_AVAILABLE)
+
+#if defined(WIDEVINE_CDM_AVAILABLE)
+  cdm::AddAndroidWidevine(key_systems_properties);
+#endif  // defined(WIDEVINE_CDM_AVAILABLE)
+}
+#endif  // defined(OS_ANDROID)
+
+}  // namespace
+
+// TODO(yucliu): Split CMA/Android logics into their own files.
+void AddChromecastKeySystems(
+    std::vector<std::unique_ptr<::media::KeySystemProperties>>*
+        key_systems_properties,
+    bool enable_persistent_license_support,
+    bool force_software_crypto) {
+#if BUILDFLAG(IS_CAST_USING_CMA_BACKEND)
+  AddCmaKeySystems(key_systems_properties, enable_persistent_license_support);
+#elif defined(OS_ANDROID)
+  AddCastAndroidKeySystems(key_systems_properties);
+#endif  // defined(OS_ANDROID)
+}
 
 }  // namespace media
 }  // namespace chromecast

diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index aeb23ca..2a7446d 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM

@@ -1 +1 @@
-9896.0.0
\ No newline at end of file
+9900.0.0
\ No newline at end of file

diff --git a/chromeos/chromeos_switches.cc b/chromeos/chromeos_switches.cc
index 7a5f53c..3e499c1b 100644
--- a/chromeos/chromeos_switches.cc
+++ b/chromeos/chromeos_switches.cc

@@ -84,6 +84,13 @@
 // If it is not set, then ARC is started in default mode.
 const char kArcStartMode[] = "arc-start-mode";
 
+// If this flag is present then the device had ARC M available and gets ARC N
+// when updating.
+// TODO(pmarko): Remove this when we assess that it's not necessary anymore:
+// crbug.com/761348.
+const char kArcTransitionMigrationRequired[] =
+    "arc-transition-migration-required";
+
 // Screenshot testing: specifies the directoru where artifacts will be stored.
 const char kArtifactsDir[] = "artifacts-dir";
 

diff --git a/chromeos/chromeos_switches.h b/chromeos/chromeos_switches.h
index b2e05ac2..c66167b 100644
--- a/chromeos/chromeos_switches.h
+++ b/chromeos/chromeos_switches.h

@@ -30,6 +30,7 @@
 CHROMEOS_EXPORT extern const char kAppOemManifestFile[];
 CHROMEOS_EXPORT extern const char kArcAvailability[];
 CHROMEOS_EXPORT extern const char kArcAvailable[];
+CHROMEOS_EXPORT extern const char kArcTransitionMigrationRequired[];
 CHROMEOS_EXPORT extern const char kArcStartMode[];
 CHROMEOS_EXPORT extern const char kArtifactsDir[];
 CHROMEOS_EXPORT extern const char kAshWebUIInit[];

diff --git a/chromeos/network/certificate_helper.cc b/chromeos/network/certificate_helper.cc
index 843d68f..8444faf3 100644
--- a/chromeos/network/certificate_helper.cc
+++ b/chromeos/network/certificate_helper.cc

@@ -4,6 +4,7 @@
 
 #include "chromeos/network/certificate_helper.h"
 
+#include <cert.h>
 #include <certdb.h>
 #include <pk11pub.h>
 #include <secport.h>
@@ -29,7 +30,7 @@
   return !s.empty() ? s : alternative_text;
 }
 
-std::string GetNickname(net::X509Certificate::OSCertHandle cert_handle) {
+std::string GetNickname(CERTCertificate* cert_handle) {
   if (!cert_handle->nickname)
     return std::string();
   std::string name = cert_handle->nickname;
@@ -43,7 +44,7 @@
 
 }  // namespace
 
-net::CertType GetCertType(net::X509Certificate::OSCertHandle cert_handle) {
+net::CertType GetCertType(CERTCertificate* cert_handle) {
   CERTCertTrust trust = {0};
   CERT_GetCertTrust(cert_handle, &trust);
 
@@ -63,28 +64,26 @@
   return net::OTHER_CERT;
 }
 
-std::string GetCertTokenName(net::X509Certificate::OSCertHandle cert_handle) {
+std::string GetCertTokenName(CERTCertificate* cert_handle) {
   std::string token;
   if (cert_handle->slot)
     token = PK11_GetTokenName(cert_handle->slot);
   return token;
 }
 
-std::string GetIssuerCommonName(net::X509Certificate::OSCertHandle cert_handle,
+std::string GetIssuerCommonName(CERTCertificate* cert_handle,
                                 const std::string& alternative_text) {
   return Stringize(CERT_GetCommonName(&cert_handle->issuer), alternative_text);
 }
 
-std::string GetCertNameOrNickname(
-    net::X509Certificate::OSCertHandle cert_handle) {
+std::string GetCertNameOrNickname(CERTCertificate* cert_handle) {
   std::string name = GetCertAsciiNameOrNickname(cert_handle);
   if (!name.empty())
     name = base::UTF16ToUTF8(url_formatter::IDNToUnicode(name));
   return name;
 }
 
-std::string GetCertAsciiNameOrNickname(
-    net::X509Certificate::OSCertHandle cert_handle) {
+std::string GetCertAsciiNameOrNickname(CERTCertificate* cert_handle) {
   std::string alternative_text = GetNickname(cert_handle);
   return Stringize(CERT_GetCommonName(&cert_handle->subject), alternative_text);
 }

diff --git a/chromeos/network/certificate_helper.h b/chromeos/network/certificate_helper.h
index 4b2a2f1..b49a2ad1 100644
--- a/chromeos/network/certificate_helper.h
+++ b/chromeos/network/certificate_helper.h

@@ -10,7 +10,6 @@
 
 #include "chromeos/chromeos_export.h"
 #include "net/cert/cert_type.h"
-#include "net/cert/x509_certificate.h"
 
 namespace chromeos {
 namespace certificate {
@@ -18,18 +17,16 @@
 // Selected functions from chrome/common/net/x509_certificate_model.cc
 
 // Decodes the certificate type from |cert|.
-CHROMEOS_EXPORT net::CertType GetCertType(
-    net::X509Certificate::OSCertHandle cert_handle);
+CHROMEOS_EXPORT net::CertType GetCertType(CERTCertificate* cert_handle);
 
 // Extracts the token name from |cert|->slot if it exists or returns an empty
 // string.
-CHROMEOS_EXPORT std::string GetCertTokenName(
-    net::X509Certificate::OSCertHandle cert_handle);
+CHROMEOS_EXPORT std::string GetCertTokenName(CERTCertificate* cert_handle);
 
 // Returns the common name for |cert_handle|->issuer or |alternative_text| if
 // the common name is missing or empty.
 CHROMEOS_EXPORT std::string GetIssuerCommonName(
-    net::X509Certificate::OSCertHandle cert_handle,
+    CERTCertificate* cert_handle,
     const std::string& alternative_text);
 
 // Returns the common name for |cert_handle|->subject converted to unicode,
@@ -37,12 +34,11 @@
 // NOTE: Unlike x509_certificate_model::GetCertNameOrNickname in src/chrome,
 // the raw unformated name or nickname will not be included in the returned
 // value (see GetCertAsciiNameOrNickname instead).
-CHROMEOS_EXPORT std::string GetCertNameOrNickname(
-    net::X509Certificate::OSCertHandle cert_handle);
+CHROMEOS_EXPORT std::string GetCertNameOrNickname(CERTCertificate* cert_handle);
 
 // Returns the unformated ASCII common name for |cert_handle|->subject.
 CHROMEOS_EXPORT std::string GetCertAsciiNameOrNickname(
-    net::X509Certificate::OSCertHandle cert_handle);
+    CERTCertificate* cert_handle);
 
 }  // namespace certificate
 }  // namespace chromeos

diff --git a/chromeos/network/certificate_helper_unittest.cc b/chromeos/network/certificate_helper_unittest.cc
index a34bbd74b..8ac8a20 100644
--- a/chromeos/network/certificate_helper_unittest.cc
+++ b/chromeos/network/certificate_helper_unittest.cc

@@ -13,34 +13,32 @@
 namespace chromeos {
 
 TEST(CertificateHelperTest, GetCertNameOrNickname) {
-  scoped_refptr<net::X509Certificate> cert(net::ImportCertFromFile(
+  net::ScopedCERTCertificate cert(net::ImportCERTCertificateFromFile(
       net::GetTestCertsDirectory(), "root_ca_cert.pem"));
   ASSERT_TRUE(cert.get());
-  EXPECT_EQ("Test Root CA",
-            certificate::GetCertNameOrNickname(cert->os_cert_handle()));
+  EXPECT_EQ("Test Root CA", certificate::GetCertNameOrNickname(cert.get()));
 
-  scoped_refptr<net::X509Certificate> punycode_cert(net::ImportCertFromFile(
+  net::ScopedCERTCertificate punycode_cert(net::ImportCERTCertificateFromFile(
       net::GetTestCertsDirectory(), "punycodetest.pem"));
   ASSERT_TRUE(punycode_cert.get());
-  EXPECT_EQ("xn--wgv71a119e.com", certificate::GetCertAsciiNameOrNickname(
-                                      punycode_cert->os_cert_handle()));
-  EXPECT_EQ("日本語.com", certificate::GetCertNameOrNickname(
-                              punycode_cert->os_cert_handle()));
+  EXPECT_EQ("xn--wgv71a119e.com",
+            certificate::GetCertAsciiNameOrNickname(punycode_cert.get()));
+  EXPECT_EQ("日本語.com",
+            certificate::GetCertNameOrNickname(punycode_cert.get()));
 
-  scoped_refptr<net::X509Certificate> no_cn_cert(net::ImportCertFromFile(
+  net::ScopedCERTCertificate no_cn_cert(net::ImportCERTCertificateFromFile(
       net::GetTestCertsDirectory(), "no_subject_common_name_cert.pem"));
   ASSERT_TRUE(no_cn_cert.get());
   // Temp cert has no nickname.
-  EXPECT_EQ("",
-            certificate::GetCertNameOrNickname(no_cn_cert->os_cert_handle()));
+  EXPECT_EQ("", certificate::GetCertNameOrNickname(no_cn_cert.get()));
 }
 
 TEST(CertificateHelperTest, GetTypeCA) {
-  scoped_refptr<net::X509Certificate> cert(net::ImportCertFromFile(
+  net::ScopedCERTCertificate cert(net::ImportCERTCertificateFromFile(
       net::GetTestCertsDirectory(), "root_ca_cert.pem"));
   ASSERT_TRUE(cert.get());
 
-  EXPECT_EQ(net::CA_CERT, certificate::GetCertType(cert->os_cert_handle()));
+  EXPECT_EQ(net::CA_CERT, certificate::GetCertType(cert.get()));
 
   crypto::ScopedTestNSSDB test_nssdb;
   net::NSSCertDatabase db(crypto::ScopedPK11Slot(PK11_ReferenceSlot(
@@ -53,11 +51,11 @@
   EXPECT_TRUE(db.SetCertTrust(cert.get(), net::CA_CERT,
                               net::NSSCertDatabase::DISTRUSTED_SSL));
 
-  EXPECT_EQ(net::CA_CERT, certificate::GetCertType(cert->os_cert_handle()));
+  EXPECT_EQ(net::CA_CERT, certificate::GetCertType(cert.get()));
 }
 
 TEST(CertificateHelperTest, GetTypeServer) {
-  scoped_refptr<net::X509Certificate> cert(net::ImportCertFromFile(
+  net::ScopedCERTCertificate cert(net::ImportCERTCertificateFromFile(
       net::GetTestCertsDirectory(), "google.single.der"));
   ASSERT_TRUE(cert.get());
 
@@ -65,7 +63,7 @@
   // trust.  Currently this doesn't work.
   // TODO(mattm): make mozilla_security_manager::GetCertType smarter so we can
   // tell server certs even if they have no trust bits set.
-  EXPECT_EQ(net::OTHER_CERT, certificate::GetCertType(cert->os_cert_handle()));
+  EXPECT_EQ(net::OTHER_CERT, certificate::GetCertType(cert.get()));
 
   crypto::ScopedTestNSSDB test_nssdb;
   net::NSSCertDatabase db(crypto::ScopedPK11Slot(PK11_ReferenceSlot(
@@ -77,13 +75,13 @@
   EXPECT_TRUE(db.SetCertTrust(cert.get(), net::SERVER_CERT,
                               net::NSSCertDatabase::TRUSTED_SSL));
 
-  EXPECT_EQ(net::SERVER_CERT, certificate::GetCertType(cert->os_cert_handle()));
+  EXPECT_EQ(net::SERVER_CERT, certificate::GetCertType(cert.get()));
 
   // Test GetCertType with server certs and explicit distrust.
   EXPECT_TRUE(db.SetCertTrust(cert.get(), net::SERVER_CERT,
                               net::NSSCertDatabase::DISTRUSTED_SSL));
 
-  EXPECT_EQ(net::SERVER_CERT, certificate::GetCertType(cert->os_cert_handle()));
+  EXPECT_EQ(net::SERVER_CERT, certificate::GetCertType(cert.get()));
 }
 
 }  // namespace chromeos

diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index 6d9e69ad..952c6d5 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc

@@ -664,7 +664,7 @@
       !base::StartsWith(url.scheme(), "chrome", base::CompareCase::SENSITIVE) &&
       !url.SchemeIs(url::kAboutScheme) &&
       base::FeatureList::IsEnabled(
-          password_manager::features::kEnableManualFallbacksFilling));
+          password_manager::features::kEnableManualFallbacksFillingStandalone));
 }
 
 }  // namespace

diff --git a/components/autofill/core/browser/autofill_profile.cc b/components/autofill/core/browser/autofill_profile.cc
index 0ad521f0..b9af03a 100644
--- a/components/autofill/core/browser/autofill_profile.cc
+++ b/components/autofill/core/browser/autofill_profile.cc

@@ -749,6 +749,28 @@
   return validity_value;
 }
 
+void AutofillProfile::SetValidityFromBitfieldValue(int bitfield_value) {
+  // Compute the bitmask based on the number a bits per type. For example, this
+  // could be the two least significant bits (0b11).
+  const int kBitmask = 2 ^ validity_bits_per_type - 1;
+
+  for (ServerFieldType supported_type : supported_types_for_validation) {
+    // Apply the bitmask to the bitfield value to get the validity value of the
+    // current |supported_type|.
+    int validity_value = bitfield_value & kBitmask;
+    if (validity_value < 0 || validity_value >= UNSUPPORTED) {
+      NOTREACHED();
+      continue;
+    }
+
+    SetValidityState(supported_type,
+                     static_cast<ValidityState>(validity_value));
+
+    // Shift the bitfield value to access the validity of the next field type.
+    bitfield_value = bitfield_value >> validity_bits_per_type;
+  }
+}
+
 base::string16 AutofillProfile::GetInfoImpl(
     const AutofillType& type,
     const std::string& app_locale) const {

diff --git a/components/autofill/core/browser/autofill_profile.h b/components/autofill/core/browser/autofill_profile.h
index e9f7f80..6c133ad 100644
--- a/components/autofill/core/browser/autofill_profile.h
+++ b/components/autofill/core/browser/autofill_profile.h

@@ -208,6 +208,10 @@
   // Returns the bitfield value representing the validity state of this profile.
   int GetValidityBitfieldValue();
 
+  // Sets the validity state of the profile based on the specified
+  // |bitfield_value|.
+  void SetValidityFromBitfieldValue(int bitfield_value);
+
  private:
   typedef std::vector<const FormGroup*> FormGroupList;
 

diff --git a/components/autofill/core/browser/autofill_profile_unittest.cc b/components/autofill/core/browser/autofill_profile_unittest.cc
index 07883a8..56f5143 100644
--- a/components/autofill/core/browser/autofill_profile_unittest.cc
+++ b/components/autofill/core/browser/autofill_profile_unittest.cc

@@ -1302,4 +1302,199 @@
   EXPECT_EQ(13229, profile.GetValidityBitfieldValue());
 }
 
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_Country) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b01
+  profile.SetValidityFromBitfieldValue(1);
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(ADDRESS_HOME_COUNTRY));
+
+  // 0b10
+  profile.SetValidityFromBitfieldValue(2);
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(ADDRESS_HOME_COUNTRY));
+
+  // 0b11
+  profile.SetValidityFromBitfieldValue(3);
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_COUNTRY));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_State) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b0100
+  profile.SetValidityFromBitfieldValue(4);
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(ADDRESS_HOME_STATE));
+
+  // 0b1000
+  profile.SetValidityFromBitfieldValue(8);
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(ADDRESS_HOME_STATE));
+
+  // 0b1100
+  profile.SetValidityFromBitfieldValue(12);
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_STATE));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_Zip) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b010000
+  profile.SetValidityFromBitfieldValue(16);
+  EXPECT_EQ(AutofillProfile::EMPTY, profile.GetValidityState(ADDRESS_HOME_ZIP));
+
+  // 0b100000
+  profile.SetValidityFromBitfieldValue(32);
+  EXPECT_EQ(AutofillProfile::VALID, profile.GetValidityState(ADDRESS_HOME_ZIP));
+
+  // 0b110000
+  profile.SetValidityFromBitfieldValue(48);
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_ZIP));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_City) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b01000000
+  profile.SetValidityFromBitfieldValue(64);
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(ADDRESS_HOME_CITY));
+
+  // 0b10000000
+  profile.SetValidityFromBitfieldValue(128);
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(ADDRESS_HOME_CITY));
+
+  // 0b11000000
+  profile.SetValidityFromBitfieldValue(192);
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_CITY));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_DependentLocality) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b0100000000
+  profile.SetValidityFromBitfieldValue(256);
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(ADDRESS_HOME_DEPENDENT_LOCALITY));
+
+  // 0b1000000000
+  profile.SetValidityFromBitfieldValue(512);
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(ADDRESS_HOME_DEPENDENT_LOCALITY));
+
+  // 0b1100000000
+  profile.SetValidityFromBitfieldValue(768);
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_DEPENDENT_LOCALITY));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_Email) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b010000000000
+  profile.SetValidityFromBitfieldValue(1024);
+  EXPECT_EQ(AutofillProfile::EMPTY, profile.GetValidityState(EMAIL_ADDRESS));
+
+  // 0b100000000000
+  profile.SetValidityFromBitfieldValue(2048);
+  EXPECT_EQ(AutofillProfile::VALID, profile.GetValidityState(EMAIL_ADDRESS));
+
+  // 0b110000000000
+  profile.SetValidityFromBitfieldValue(3072);
+  EXPECT_EQ(AutofillProfile::INVALID, profile.GetValidityState(EMAIL_ADDRESS));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_Phone) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b01000000000000
+  profile.SetValidityFromBitfieldValue(4096);
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(PHONE_HOME_WHOLE_NUMBER));
+
+  // 0b10000000000000
+  profile.SetValidityFromBitfieldValue(8192);
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(PHONE_HOME_WHOLE_NUMBER));
+
+  // 0b11000000000000
+  profile.SetValidityFromBitfieldValue(12288);
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(PHONE_HOME_WHOLE_NUMBER));
+}
+
+TEST(AutofillProfileTest, SetValidityFromBitfieldValue_Mixed) {
+  AutofillProfile profile;
+
+  // By default all validity statuses should be set to UNVALIDATED, thus the
+  // bitfield value should be empty.
+  EXPECT_EQ(0, profile.GetValidityBitfieldValue());
+
+  // 0b01110011010010
+  profile.SetValidityFromBitfieldValue(7378);
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(ADDRESS_HOME_COUNTRY));
+  EXPECT_EQ(AutofillProfile::UNVALIDATED,
+            profile.GetValidityState(ADDRESS_HOME_STATE));
+  EXPECT_EQ(AutofillProfile::EMPTY, profile.GetValidityState(ADDRESS_HOME_ZIP));
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_CITY));
+  EXPECT_EQ(AutofillProfile::UNVALIDATED,
+            profile.GetValidityState(ADDRESS_HOME_DEPENDENT_LOCALITY));
+  EXPECT_EQ(AutofillProfile::INVALID, profile.GetValidityState(EMAIL_ADDRESS));
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(PHONE_HOME_WHOLE_NUMBER));
+
+  // 0b11001110101101
+  profile.SetValidityFromBitfieldValue(13229);
+  EXPECT_EQ(AutofillProfile::EMPTY,
+            profile.GetValidityState(ADDRESS_HOME_COUNTRY));
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_STATE));
+  EXPECT_EQ(AutofillProfile::VALID, profile.GetValidityState(ADDRESS_HOME_ZIP));
+  EXPECT_EQ(AutofillProfile::VALID,
+            profile.GetValidityState(ADDRESS_HOME_CITY));
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(ADDRESS_HOME_DEPENDENT_LOCALITY));
+  EXPECT_EQ(AutofillProfile::UNVALIDATED,
+            profile.GetValidityState(EMAIL_ADDRESS));
+  EXPECT_EQ(AutofillProfile::INVALID,
+            profile.GetValidityState(PHONE_HOME_WHOLE_NUMBER));
+}
+
 }  // namespace autofill

diff --git a/components/cdm/renderer/android_key_systems.cc b/components/cdm/renderer/android_key_systems.cc
index c7b3e962..a9dc30f 100644
--- a/components/cdm/renderer/android_key_systems.cc
+++ b/components/cdm/renderer/android_key_systems.cc

@@ -9,7 +9,6 @@
 
 #include "base/command_line.h"
 #include "base/logging.h"
-#include "components/cdm/common/cdm_messages_android.h"
 #include "components/cdm/renderer/widevine_key_system_properties.h"
 #include "content/public/renderer/render_thread.h"
 #include "media/base/eme_constants.h"
@@ -92,6 +91,8 @@
   const SupportedCodecs supported_codecs_;
 };
 
+}  // namespace
+
 SupportedKeySystemResponse QueryKeySystemSupport(
     const std::string& key_system) {
   SupportedKeySystemRequest request;
@@ -109,8 +110,6 @@
   return response;
 }
 
-}  // namespace
-
 void AddAndroidWidevine(
     std::vector<std::unique_ptr<KeySystemProperties>>* concrete_key_systems) {
   SupportedKeySystemResponse response = QueryKeySystemSupport(

diff --git a/components/cdm/renderer/android_key_systems.h b/components/cdm/renderer/android_key_systems.h
index f5111c7..b92e367 100644
--- a/components/cdm/renderer/android_key_systems.h
+++ b/components/cdm/renderer/android_key_systems.h

@@ -8,6 +8,7 @@
 #include <memory>
 #include <vector>
 
+#include "components/cdm/common/cdm_messages_android.h"
 #include "media/base/key_system_properties.h"
 
 namespace cdm {
@@ -22,6 +23,9 @@
     std::vector<std::unique_ptr<media::KeySystemProperties>>*
         concrete_key_systems);
 
+// Query key system property in browser process.
+SupportedKeySystemResponse QueryKeySystemSupport(const std::string& key_system);
+
 }  // namespace cdm
 
 #endif  // COMPONENTS_CDM_RENDERER_ANDROID_KEY_SYSTEMS_H_

diff --git a/components/content_settings/core/browser/website_settings_registry.cc b/components/content_settings/core/browser/website_settings_registry.cc
index 6dc97a4..7d62b4d1 100644
--- a/components/content_settings/core/browser/website_settings_registry.cc
+++ b/components/content_settings/core/browser/website_settings_registry.cc

@@ -174,7 +174,7 @@
            DESKTOP | PLATFORM_ANDROID,
            WebsiteSettingsInfo::INHERIT_IN_INCOGNITO);
   Register(CONTENT_SETTINGS_TYPE_MEDIA_ENGAGEMENT, "media-engagement", nullptr,
-           WebsiteSettingsInfo::SYNCABLE, WebsiteSettingsInfo::LOSSY,
+           WebsiteSettingsInfo::UNSYNCABLE, WebsiteSettingsInfo::LOSSY,
            WebsiteSettingsInfo::REQUESTING_ORIGIN_ONLY_SCOPE,
            DESKTOP | PLATFORM_ANDROID,
            WebsiteSettingsInfo::INHERIT_IN_INCOGNITO);

diff --git a/components/crash/content/app/crash_export_stubs.cc b/components/crash/content/app/crash_export_stubs.cc
index 6babd35..4e10970 100644
--- a/components/crash/content/app/crash_export_stubs.cc
+++ b/components/crash/content/app/crash_export_stubs.cc

@@ -12,41 +12,44 @@
 #include "components/crash/content/app/crash_export_thunks.h"
 #include "components/crash/content/app/crashpad.h"
 
-void RequestSingleCrashUploadThunk(const char* local_id) {}
+void RequestSingleCrashUpload_ExportThunk(const char* local_id) {}
 
-size_t GetCrashReportsImpl(crash_reporter::Report* reports,
-                           size_t reports_size) {
+size_t GetCrashReports_ExportThunk(crash_reporter::Report* reports,
+                                   size_t reports_size) {
   return 0;
 }
 
-int CrashForException(EXCEPTION_POINTERS* info) {
+int CrashForException_ExportThunk(EXCEPTION_POINTERS* info) {
   // Make sure to properly crash the process by dispatching directly to the
   // Windows unhandled exception filter.
   return UnhandledExceptionFilter(info);
 }
 
-void SetUploadConsentImpl(bool consent) {}
+void SetUploadConsent_ExportThunk(bool consent) {}
 
-void SetCrashKeyValueImpl(const wchar_t* key, const wchar_t* value) {}
+void SetCrashKeyValue_ExportThunk(const wchar_t* key, const wchar_t* value) {}
 
-void ClearCrashKeyValueImpl(const wchar_t* key) {}
+void ClearCrashKeyValue_ExportThunk(const wchar_t* key) {}
 
-void SetCrashKeyValueImplEx(const char* key, const char* value) {}
+void SetCrashKeyValueEx_ExportThunk(const char* key, const char* value) {}
 
-void ClearCrashKeyValueImplEx(const char* key) {}
+void ClearCrashKeyValueEx_ExportThunk(const char* key) {}
 
-HANDLE InjectDumpForHungInput(HANDLE process, void* serialized_crash_keys) {
+HANDLE InjectDumpForHungInput_ExportThunk(HANDLE process,
+                                          void* serialized_crash_keys) {
   return nullptr;
 }
 
-HANDLE InjectDumpForHungInputNoCrashKeys(HANDLE process, int reason) {
+HANDLE InjectDumpForHungInputNoCrashKeys_ExportThunk(HANDLE process,
+                                                     int reason) {
   return nullptr;
 }
 
 #if defined(ARCH_CPU_X86_64)
 
-void RegisterNonABICompliantCodeRange(void* start, size_t size_in_bytes) {}
+void RegisterNonABICompliantCodeRange_ExportThunk(void* start,
+                                                  size_t size_in_bytes) {}
 
-void UnregisterNonABICompliantCodeRange(void* start) {}
+void UnregisterNonABICompliantCodeRange_ExportThunk(void* start) {}
 
 #endif  // defined(ARCH_CPU_X86_64)

diff --git a/components/crash/content/app/crash_export_thunks.cc b/components/crash/content/app/crash_export_thunks.cc
index 28c40a9..630956f 100644
--- a/components/crash/content/app/crash_export_thunks.cc
+++ b/components/crash/content/app/crash_export_thunks.cc

@@ -12,12 +12,12 @@
 #include "components/crash/content/app/crashpad.h"
 #include "third_party/crashpad/crashpad/client/crashpad_client.h"
 
-void RequestSingleCrashUploadImpl(const char* local_id) {
+void RequestSingleCrashUpload_ExportThunk(const char* local_id) {
   crash_reporter::RequestSingleCrashUploadImpl(local_id);
 }
 
-size_t GetCrashReportsImpl(crash_reporter::Report* reports,
-                           size_t reports_size) {
+size_t GetCrashReports_ExportThunk(crash_reporter::Report* reports,
+                                   size_t reports_size) {
   static_assert(std::is_pod<crash_reporter::Report>::value,
                 "crash_reporter::Report must be POD");
   // Since this could be called across module boundaries, retrieve the full
@@ -36,7 +36,7 @@
   return crash_reports.size();
 }
 
-int CrashForException(EXCEPTION_POINTERS* info) {
+int CrashForException_ExportThunk(EXCEPTION_POINTERS* info) {
   crash_reporter::GetCrashpadClient().DumpAndCrash(info);
   return EXCEPTION_CONTINUE_SEARCH;
 }
@@ -48,7 +48,7 @@
 // be consistent with
 // crash_reporter::GetCrashReporterClient()->GetCollectStatsConsent(), but it's
 // not enforced to avoid blocking startup code on synchronizing them.
-void SetUploadConsentImpl(bool consent) {
+void SetUploadConsent_ExportThunk(bool consent) {
   crash_reporter::SetUploadConsent(consent);
 }
 
@@ -56,31 +56,33 @@
 // change the name or signature of this function you will break SyzyASAN
 // instrumented releases of Chrome. Please contact syzygy-team@chromium.org
 // before doing so! See also http://crbug.com/567781.
-void SetCrashKeyValueImpl(const wchar_t* key, const wchar_t* value) {
+void SetCrashKeyValue_ExportThunk(const wchar_t* key, const wchar_t* value) {
   crash_reporter::SetCrashKeyValue(base::UTF16ToUTF8(key),
                                    base::UTF16ToUTF8(value));
 }
 
-void ClearCrashKeyValueImpl(const wchar_t* key) {
+void ClearCrashKeyValue_ExportThunk(const wchar_t* key) {
   crash_reporter::ClearCrashKey(base::UTF16ToUTF8(key));
 }
 
-void SetCrashKeyValueImplEx(const char* key, const char* value) {
+void SetCrashKeyValueEx_ExportThunk(const char* key, const char* value) {
   crash_reporter::SetCrashKeyValue(key, value);
 }
 
-void ClearCrashKeyValueImplEx(const char* key) {
+void ClearCrashKeyValueEx_ExportThunk(const char* key) {
   crash_reporter::ClearCrashKey(key);
 }
 
-HANDLE InjectDumpForHungInput(HANDLE process, void* serialized_crash_keys) {
+HANDLE InjectDumpForHungInput_ExportThunk(HANDLE process,
+                                          void* serialized_crash_keys) {
   return CreateRemoteThread(
       process, nullptr, 0,
       crash_reporter::internal::DumpProcessForHungInputThread,
       serialized_crash_keys, 0, nullptr);
 }
 
-HANDLE InjectDumpForHungInputNoCrashKeys(HANDLE process, int reason) {
+HANDLE InjectDumpForHungInputNoCrashKeys_ExportThunk(HANDLE process,
+                                                     int reason) {
   return CreateRemoteThread(
       process, nullptr, 0,
       crash_reporter::internal::DumpProcessForHungInputNoCrashKeysThread,
@@ -89,12 +91,13 @@
 
 #if defined(ARCH_CPU_X86_64)
 
-void RegisterNonABICompliantCodeRange(void* start, size_t size_in_bytes) {
+void RegisterNonABICompliantCodeRange_ExportThunk(void* start,
+                                                  size_t size_in_bytes) {
   crash_reporter::internal::RegisterNonABICompliantCodeRangeImpl(start,
                                                                  size_in_bytes);
 }
 
-void UnregisterNonABICompliantCodeRange(void* start) {
+void UnregisterNonABICompliantCodeRange_ExportThunk(void* start) {
   crash_reporter::internal::UnregisterNonABICompliantCodeRangeImpl(start);
 }
 

diff --git a/components/crash/content/app/crash_export_thunks.h b/components/crash/content/app/crash_export_thunks.h
index 5fe49fc5..4e04054f 100644
--- a/components/crash/content/app/crash_export_thunks.h
+++ b/components/crash/content/app/crash_export_thunks.h

@@ -16,19 +16,22 @@
 
 extern "C" {
 
-// TODO(siggi): Rename these functions to something descriptive and unique,
-//   once all the thunks have been converted to import binding.
+// All the functions in this file are named with a suffix of _ExportThunk to
+// make sure their names cannot easily collide with random other functions.
+// The Microsoft Visual Studio linker has a misfeature where it searches rather
+// aggressively for functions to match exports in .DEF files.
+// See https://crbug.com/760385#c11 for how this can be bad.
 
 // This function may be invoked across module boundaries to request a single
 // crash report upload. See CrashUploadListCrashpad.
-void RequestSingleCrashUploadImpl(const char* local_id);
+void RequestSingleCrashUpload_ExportThunk(const char* local_id);
 
 // This function may be invoked across module boundaries to retrieve the crash
 // list. It copies up to |report_count| reports into |reports| and returns the
 // number of reports available. If the return value is less than or equal to
 // |reports_size|, then |reports| contains all the available reports.
-size_t GetCrashReportsImpl(crash_reporter::Report* reports,
-                           size_t reports_size);
+size_t GetCrashReports_ExportThunk(crash_reporter::Report* reports,
+                                   size_t reports_size);
 
 // Crashes the process after generating a dump for the provided exception. Note
 // that the crash reporter should be initialized before calling this function
@@ -36,7 +39,7 @@
 // NOTE: This function is used by SyzyASAN to invoke a crash. If you change the
 // the name or signature of this function you will break SyzyASAN instrumented
 // releases of Chrome. Please contact syzygy-team@chromium.org before doing so!
-int CrashForException(EXCEPTION_POINTERS* info);
+int CrashForException_ExportThunk(EXCEPTION_POINTERS* info);
 
 // This function is used in chrome_metrics_services_manager_client.cc to trigger
 // changes to the upload-enabled state. This is done when the metrics services
@@ -45,19 +48,19 @@
 // be consistent with
 // crash_reporter::GetCrashReporterClient()->GetCollectStatsConsent(), but it's
 // not enforced to avoid blocking startup code on synchronizing them.
-void SetUploadConsentImpl(bool consent);
+void SetUploadConsent_ExportThunk(bool consent);
 
 // NOTE: This function is used by SyzyASAN to annotate crash reports. If you
 // change the name or signature of this function you will break SyzyASAN
 // instrumented releases of Chrome. Please contact syzygy-team@chromium.org
 // before doing so! See also http://crbug.com/567781.
-void SetCrashKeyValueImpl(const wchar_t* key, const wchar_t* value);
+void SetCrashKeyValue_ExportThunk(const wchar_t* key, const wchar_t* value);
 
-void ClearCrashKeyValueImpl(const wchar_t* key);
+void ClearCrashKeyValue_ExportThunk(const wchar_t* key);
 
-void SetCrashKeyValueImplEx(const char* key, const char* value);
+void SetCrashKeyValueEx_ExportThunk(const char* key, const char* value);
 
-void ClearCrashKeyValueImplEx(const char* key);
+void ClearCrashKeyValueEx_ExportThunk(const char* key);
 
 // Injects a thread into a remote process to dump state when there is no crash.
 // |serialized_crash_keys| is a nul terminated string in the address space of
@@ -65,17 +68,20 @@
 // Keys and values are separated by ':', and key/value pairs are separated by
 // ','. All keys should be previously registered as crash keys.
 // This method is used solely to classify hung input.
-HANDLE InjectDumpForHungInput(HANDLE process, void* serialized_crash_keys);
+HANDLE InjectDumpForHungInput_ExportThunk(HANDLE process,
+                                          void* serialized_crash_keys);
 
 // Injects a thread into a remote process to dump state when there is no crash.
 // This method provides |reason| which will interpreted as an integer and logged
 // as a crash key.
-HANDLE InjectDumpForHungInputNoCrashKeys(HANDLE process, int reason);
+HANDLE InjectDumpForHungInputNoCrashKeys_ExportThunk(HANDLE process,
+                                                     int reason);
 
 #if defined(ARCH_CPU_X86_64)
 // V8 support functions.
-void RegisterNonABICompliantCodeRange(void* start, size_t size_in_bytes);
-void UnregisterNonABICompliantCodeRange(void* start);
+void RegisterNonABICompliantCodeRange_ExportThunk(void* start,
+                                                  size_t size_in_bytes);
+void UnregisterNonABICompliantCodeRange_ExportThunk(void* start);
 #endif  // defined(ARCH_CPU_X86_64)
 
 }  // extern "C"

diff --git a/components/crash/content/app/crashpad.cc b/components/crash/content/app/crashpad.cc
index aface8d..5e1302b0 100644
--- a/components/crash/content/app/crashpad.cc
+++ b/components/crash/content/app/crashpad.cc

@@ -261,7 +261,7 @@
   reports->resize(25);
   while (true) {
     size_t available_reports =
-        GetCrashReportsImpl(&reports->at(0), reports->size());
+        GetCrashReports_ExportThunk(&reports->at(0), reports->size());
     if (available_reports <= reports->size()) {
       // The input size was large enough to capture all available crashes.
       // Trim the vector to the actual number of reports returned and return.
@@ -283,7 +283,7 @@
 #if defined(OS_WIN)
   // On Windows, crash reporting may be implemented in another module, which is
   // why this can't call crash_reporter::RequestSingleCrashUpload directly.
-  RequestSingleCrashUploadImpl(local_id);
+  RequestSingleCrashUpload_ExportThunk(local_id.c_str());
 #else
   crash_reporter::RequestSingleCrashUploadImpl(local_id);
 #endif

diff --git a/components/crash/content/app/crashpad_win.cc b/components/crash/content/app/crashpad_win.cc
index bb5c097..3a33c9b 100644
--- a/components/crash/content/app/crashpad_win.cc
+++ b/components/crash/content/app/crashpad_win.cc

@@ -205,7 +205,7 @@
     PCONTEXT ContextRecord,
     PDISPATCHER_CONTEXT DispatcherContext) {
   EXCEPTION_POINTERS info = { ExceptionRecord, ContextRecord };
-  return CrashForException(&info);
+  return CrashForException_ExportThunk(&info);
 }
 
 // See https://msdn.microsoft.com/en-us/library/ddssxxy8.aspx
@@ -225,9 +225,7 @@
   unsigned char thunk[12];
 };
 
-// These are GetProcAddress()d from V8 binding code.
-void __cdecl RegisterNonABICompliantCodeRangeImpl(void* start,
-                                                  size_t size_in_bytes) {
+void RegisterNonABICompliantCodeRangeImpl(void* start, size_t size_in_bytes) {
   ExceptionHandlerRecord* record =
       reinterpret_cast<ExceptionHandlerRecord*>(start);
 

diff --git a/components/cronet/android/BUILD.gn b/components/cronet/android/BUILD.gn
index d33675e..b3b5391 100644
--- a/components/cronet/android/BUILD.gn
+++ b/components/cronet/android/BUILD.gn

@@ -326,6 +326,7 @@
   deps = [
     ":cronet_api_java",
     ":cronet_impl_common_java",
+    "//third_party/android_tools:android_support_annotations_java",
     "//third_party/jsr-305:jsr_305_javalib",
   ]
 }

diff --git a/components/cronet/android/java/src/org/chromium/net/impl/InputStreamChannel.java b/components/cronet/android/java/src/org/chromium/net/impl/InputStreamChannel.java
index 8731351..f168ba18 100644
--- a/components/cronet/android/java/src/org/chromium/net/impl/InputStreamChannel.java
+++ b/components/cronet/android/java/src/org/chromium/net/impl/InputStreamChannel.java

@@ -4,6 +4,8 @@
 
 package org.chromium.net.impl;
 
+import android.support.annotation.NonNull;
+
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -23,11 +25,11 @@
     private final InputStream mInputStream;
     private final AtomicBoolean mIsOpen = new AtomicBoolean(true);
 
-    private InputStreamChannel(InputStream inputStream) {
+    private InputStreamChannel(@NonNull InputStream inputStream) {
         mInputStream = inputStream;
     }
 
-    static ReadableByteChannel wrap(InputStream inputStream) {
+    static ReadableByteChannel wrap(@NonNull InputStream inputStream) {
         if (inputStream instanceof FileInputStream) {
             return ((FileInputStream) inputStream).getChannel();
         }

diff --git a/components/cronet/android/java/src/org/chromium/net/impl/JavaUrlRequest.java b/components/cronet/android/java/src/org/chromium/net/impl/JavaUrlRequest.java
index 4d103b4..ef7cea86 100644
--- a/components/cronet/android/java/src/org/chromium/net/impl/JavaUrlRequest.java
+++ b/components/cronet/android/java/src/org/chromium/net/impl/JavaUrlRequest.java

@@ -8,6 +8,7 @@
 import android.annotation.TargetApi;
 import android.net.TrafficStats;
 import android.os.Build;
+import android.support.annotation.Nullable;
 import android.util.Log;
 
 import org.chromium.net.CronetException;
@@ -17,6 +18,7 @@
 import org.chromium.net.UrlResponseInfo;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.HttpURLConnection;
 import java.net.URI;
@@ -96,6 +98,7 @@
 
     /* These change with redirects. */
     private String mCurrentUrl;
+    @Nullable
     private ReadableByteChannel mResponseChannel; // Only accessed on mExecutor.
     private UrlResponseInfoImpl mUrlResponseInfo;
     private String mPendingRedirectUrl;
@@ -630,8 +633,9 @@
                 }
                 fireCloseUploadDataProvider();
                 if (responseCode >= 400) {
+                    InputStream inputStream = mCurrentUrlConnection.getErrorStream();
                     mResponseChannel =
-                            InputStreamChannel.wrap(mCurrentUrlConnection.getErrorStream());
+                            inputStream == null ? null : InputStreamChannel.wrap(inputStream);
                     mCallbackAsync.onResponseStarted(mUrlResponseInfo);
                 } else {
                     mResponseChannel =
@@ -768,7 +772,7 @@
                 mExecutor.execute(errorSetting(new CheckedRunnable() {
                     @Override
                     public void run() throws Exception {
-                        int read = mResponseChannel.read(buffer);
+                        int read = mResponseChannel == null ? -1 : mResponseChannel.read(buffer);
                         processReadResult(read, buffer);
                     }
                 }));
@@ -780,7 +784,9 @@
         if (read != -1) {
             mCallbackAsync.onReadCompleted(mUrlResponseInfo, buffer);
         } else {
-            mResponseChannel.close();
+            if (mResponseChannel != null) {
+                mResponseChannel.close();
+            }
             if (mState.compareAndSet(State.READING, State.COMPLETE)) {
                 fireDisconnect();
                 mCallbackAsync.onSucceeded(mUrlResponseInfo);

diff --git a/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlRequestTest.java b/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlRequestTest.java
index b649075b..b98ef3f 100644
--- a/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlRequestTest.java
+++ b/components/cronet/android/test/javatests/src/org/chromium/net/CronetUrlRequestTest.java

@@ -2159,4 +2159,15 @@
             // leak.
         }
     }
+
+    @SmallTest
+    @Feature({"Cronet"})
+    /** Do a HEAD request and get back a 404. */
+    public void test404Head() throws Exception {
+        TestUrlRequestCallback callback = new TestUrlRequestCallback();
+        UrlRequest.Builder builder = mTestFramework.mCronetEngine.newUrlRequestBuilder(
+                NativeTestServer.getFileURL("/notfound.html"), callback, callback.getExecutor());
+        builder.setHttpMethod("HEAD").build().start();
+        callback.blockForDone();
+    }
 }

diff --git a/components/download/internal/android/network_status_listener_android.cc b/components/download/internal/android/network_status_listener_android.cc
index e33d181..0817e93 100644
--- a/components/download/internal/android/network_status_listener_android.cc
+++ b/components/download/internal/android/network_status_listener_android.cc

@@ -20,7 +20,7 @@
   DCHECK(observer_);
   using ConnectionType = net::NetworkChangeNotifier::ConnectionType;
   ConnectionType connection_type = static_cast<ConnectionType>(connectionType);
-  observer_->OnConnectionTypeChanged(connection_type);
+  observer_->OnNetworkChanged(connection_type);
 }
 
 void NetworkStatusListenerAndroid::Start(

diff --git a/components/download/internal/scheduler/device_status_listener.cc b/components/download/internal/scheduler/device_status_listener.cc
index 0a7f2fe..a3eefb5 100644
--- a/components/download/internal/scheduler/device_status_listener.cc
+++ b/components/download/internal/scheduler/device_status_listener.cc

@@ -93,7 +93,7 @@
   observer_ = nullptr;
 }
 
-void DeviceStatusListener::OnConnectionTypeChanged(
+void DeviceStatusListener::OnNetworkChanged(
     net::NetworkChangeNotifier::ConnectionType type) {
   NetworkStatus new_network_status = ToNetworkStatus(type);
   if (status_.network_status == new_network_status)
@@ -105,6 +105,9 @@
 
   // It's unreliable to send requests immediately after the network becomes
   // online. Notify network change to the observer after a delay.
+  // (With crbug.com/754695, the online signal comes after the network has
+  // been established, so the above statement might not be true and the delay
+  // might not be necessary.)
   if (change_to_online) {
     timer_.Start(
         FROM_HERE, delay_,

diff --git a/components/download/internal/scheduler/device_status_listener.h b/components/download/internal/scheduler/device_status_listener.h
index af3c21a..a127645 100644
--- a/components/download/internal/scheduler/device_status_listener.h
+++ b/components/download/internal/scheduler/device_status_listener.h

@@ -54,7 +54,7 @@
 
  private:
   // NetworkStatusListener::Observer implementation.
-  void OnConnectionTypeChanged(
+  void OnNetworkChanged(
       net::NetworkChangeNotifier::ConnectionType type) override;
 
   // base::PowerObserver implementation.

diff --git a/components/download/internal/scheduler/device_status_listener_unittest.cc b/components/download/internal/scheduler/device_status_listener_unittest.cc
index e2f592f4..2b957bbd 100644
--- a/components/download/internal/scheduler/device_status_listener_unittest.cc
+++ b/components/download/internal/scheduler/device_status_listener_unittest.cc

@@ -36,8 +36,7 @@
   // Changes the network type.
   void ChangeNetworkType(ConnectionType type) {
     conn_type_ = type;
-    net::NetworkChangeNotifier::NotifyObserversOfConnectionTypeChangeForTests(
-        type);
+    net::NetworkChangeNotifier::NotifyObserversOfNetworkChangeForTests(type);
   }
 
  private:

diff --git a/components/download/internal/scheduler/network_status_listener.cc b/components/download/internal/scheduler/network_status_listener.cc
index c5d05f4..c5e406a 100644
--- a/components/download/internal/scheduler/network_status_listener.cc
+++ b/components/download/internal/scheduler/network_status_listener.cc

@@ -23,11 +23,11 @@
 void NetworkStatusListenerImpl::Start(
     NetworkStatusListener::Observer* observer) {
   NetworkStatusListener::Start(observer);
-  net::NetworkChangeNotifier::AddConnectionTypeObserver(this);
+  net::NetworkChangeNotifier::AddNetworkChangeObserver(this);
 }
 
 void NetworkStatusListenerImpl::Stop() {
-  net::NetworkChangeNotifier::RemoveConnectionTypeObserver(this);
+  net::NetworkChangeNotifier::RemoveNetworkChangeObserver(this);
   NetworkStatusListener::Stop();
 }
 
@@ -36,10 +36,10 @@
   return net::NetworkChangeNotifier::GetConnectionType();
 }
 
-void NetworkStatusListenerImpl::OnConnectionTypeChanged(
+void NetworkStatusListenerImpl::OnNetworkChanged(
     net::NetworkChangeNotifier::ConnectionType type) {
   DCHECK(observer_);
-  observer_->OnConnectionTypeChanged(type);
+  observer_->OnNetworkChanged(type);
 }
 
 }  // namespace download

diff --git a/components/download/internal/scheduler/network_status_listener.h b/components/download/internal/scheduler/network_status_listener.h
index 4d5a80d..e769c800 100644
--- a/components/download/internal/scheduler/network_status_listener.h
+++ b/components/download/internal/scheduler/network_status_listener.h

@@ -18,7 +18,7 @@
   // Observer to receive network connection type change notifications.
   class Observer {
    public:
-    virtual void OnConnectionTypeChanged(
+    virtual void OnNetworkChanged(
         net::NetworkChangeNotifier::ConnectionType type) = 0;
 
    protected:
@@ -53,7 +53,7 @@
 // Default implementation of NetworkStatusListener using
 // net::NetworkChangeNotifier to listen to connectivity changes.
 class NetworkStatusListenerImpl
-    : public net::NetworkChangeNotifier::ConnectionTypeObserver,
+    : public net::NetworkChangeNotifier::NetworkChangeObserver,
       public NetworkStatusListener {
  public:
   NetworkStatusListenerImpl();
@@ -65,8 +65,8 @@
   net::NetworkChangeNotifier::ConnectionType GetConnectionType() override;
 
  private:
-  // net::NetworkChangeNotifier::ConnectionTypeObserver implementation.
-  void OnConnectionTypeChanged(
+  // net::NetworkChangeNotifier::NetworkChangeObserver implementation.
+  void OnNetworkChanged(
       net::NetworkChangeNotifier::ConnectionType type) override;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkStatusListenerImpl);

diff --git a/components/exo/display.cc b/components/exo/display.cc
index 6bf7395a0..f77bdfa 100644
--- a/components/exo/display.cc
+++ b/components/exo/display.cc

@@ -183,7 +183,8 @@
 
 std::unique_ptr<ShellSurface> Display::CreateRemoteShellSurface(
     Surface* surface,
-    int container) {
+    int container,
+    bool scale_by_defult_device_scale_factor) {
   TRACE_EVENT2("exo", "Display::CreateRemoteShellSurface", "surface",
                surface->AsTracedValue(), "container", container);
 
@@ -195,9 +196,14 @@
   // Remote shell surfaces in system modal container cannot be minimized.
   bool can_minimize = container != ash::kShellWindowId_SystemModalContainer;
 
-  return base::MakeUnique<ShellSurface>(
+  std::unique_ptr<ShellSurface> shell_surface(base::MakeUnique<ShellSurface>(
       surface, nullptr, ShellSurface::BoundsMode::CLIENT, gfx::Point(),
-      true /* activatable */, can_minimize, container);
+      true /* activatable */, can_minimize, container));
+  if (scale_by_defult_device_scale_factor) {
+    shell_surface->SetScale(
+        WMHelper::GetInstance()->GetDefaultDeviceScaleFactor());
+  }
+  return shell_surface;
 }
 
 std::unique_ptr<SubSurface> Display::CreateSubSurface(Surface* surface,

diff --git a/components/exo/display.h b/components/exo/display.h
index e115d20..154fd9663 100644
--- a/components/exo/display.h
+++ b/components/exo/display.h

@@ -80,7 +80,8 @@
   // Creates a remote shell surface for an existing surface using |container|.
   std::unique_ptr<ShellSurface> CreateRemoteShellSurface(
       Surface* surface,
-      int container);
+      int container,
+      bool scale_by_default_device_scale_factor);
 
   // Creates a sub-surface for an existing surface. The sub-surface will be
   // a child of |parent|.

diff --git a/components/exo/display_unittest.cc b/components/exo/display_unittest.cc
index 68aca89..b1c50a3e 100644
--- a/components/exo/display_unittest.cc
+++ b/components/exo/display_unittest.cc

@@ -150,13 +150,15 @@
   // Create a remote shell surface for surface1.
   std::unique_ptr<ShellSurface> shell_surface1 =
       display->CreateRemoteShellSurface(
-          surface1.get(), ash::kShellWindowId_SystemModalContainer);
+          surface1.get(), ash::kShellWindowId_SystemModalContainer,
+          true /* scale_by_default_scale_factor */);
   EXPECT_TRUE(shell_surface1);
 
   // Create a remote shell surface for surface2.
   std::unique_ptr<ShellSurface> shell_surface2 =
-      display->CreateRemoteShellSurface(surface2.get(),
-                                        ash::kShellWindowId_DefaultContainer);
+      display->CreateRemoteShellSurface(
+          surface2.get(), ash::kShellWindowId_DefaultContainer,
+          false /* scale_by_default_scale_factor */);
   EXPECT_TRUE(shell_surface2);
 }
 

diff --git a/components/exo/shell_surface_unittest.cc b/components/exo/shell_surface_unittest.cc
index ebbbe322..5c80600 100644
--- a/components/exo/shell_surface_unittest.cc
+++ b/components/exo/shell_surface_unittest.cc

@@ -32,6 +32,7 @@
 #include "ui/compositor/compositor.h"
 #include "ui/compositor/layer.h"
 #include "ui/display/display.h"
+#include "ui/display/manager/display_manager.h"
 #include "ui/display/screen.h"
 #include "ui/views/widget/widget.h"
 #include "ui/wm/core/shadow.h"
@@ -83,9 +84,13 @@
   }
 
   std::unique_ptr<ShellSurface> CreateDefaultShellSurface(Surface* surface) {
-    return base::MakeUnique<ShellSurface>(surface, nullptr, GetParam(),
-                                          gfx::Point(), true, false,
-                                          ash::kShellWindowId_DefaultContainer);
+    if (IsClientBoundsMode()) {
+      return Display().CreateRemoteShellSurface(
+          surface, ash::kShellWindowId_DefaultContainer,
+          true /* scale_by_default_scale_factor */);
+    } else {
+      return Display().CreateShellSurface(surface);
+    }
   }
 
  private:
@@ -374,20 +379,73 @@
             shell_surface->host_window()->bounds().ToString());
 }
 
-TEST_F(ShellSurfaceTest, SetScale) {
+TEST_P(ShellSurfaceBoundsModeTest, DefaultDeviceScaleFactorForcedScaleFactor) {
+  double scale = 1.5;
+  display::Display::SetForceDeviceScaleFactor(scale);
+
+  int64_t display_id = display::Screen::GetScreen()->GetPrimaryDisplay().id();
+  display::Display::SetInternalDisplayId(display_id);
+
   gfx::Size buffer_size(64, 64);
   std::unique_ptr<Buffer> buffer(
       new Buffer(exo_test_helper()->CreateGpuMemoryBuffer(buffer_size)));
   std::unique_ptr<Surface> surface(new Surface);
-  std::unique_ptr<ShellSurface> shell_surface(new ShellSurface(surface.get()));
+  std::unique_ptr<ShellSurface> shell_surface(
+      CreateDefaultShellSurface(surface.get()));
+  surface->Attach(buffer.get());
+  surface->Commit();
+  gfx::Transform transform;
+  if (IsClientBoundsMode())
+    transform.Scale(1.0 / scale, 1.0 / scale);
 
-  double scale = 1.5;
-  shell_surface->SetScale(scale);
+  EXPECT_EQ(
+      transform.ToString(),
+      shell_surface->host_window()->layer()->GetTargetTransform().ToString());
+}
+
+TEST_P(ShellSurfaceBoundsModeTest, DefaultDeviceScaleFactorFromDisplayManager) {
+  int64_t display_id = display::Screen::GetScreen()->GetPrimaryDisplay().id();
+  display::Display::SetInternalDisplayId(display_id);
+  gfx::Size size(1920, 1080);
+
+  display::DisplayManager* display_manager =
+      ash::Shell::Get()->display_manager();
+
+  double scale = 1.25;
+  scoped_refptr<display::ManagedDisplayMode> mode(
+      new display::ManagedDisplayMode(size, 60.f, false /* overscan */,
+                                      true /*native*/, 1.0, scale));
+  mode->set_is_default(true);
+
+  display::ManagedDisplayInfo::ManagedDisplayModeList mode_list;
+  mode_list.push_back(mode);
+
+  display::ManagedDisplayInfo native_display_info(display_id, "test", false);
+  native_display_info.SetManagedDisplayModes(mode_list);
+
+  native_display_info.SetBounds(gfx::Rect(size));
+  native_display_info.set_device_scale_factor(scale);
+
+  std::vector<display::ManagedDisplayInfo> display_info_list;
+  display_info_list.push_back(native_display_info);
+
+  display_manager->OnNativeDisplaysChanged(display_info_list);
+  display_manager->UpdateInternalManagedDisplayModeListForTest();
+
+  gfx::Size buffer_size(64, 64);
+  std::unique_ptr<Buffer> buffer(
+      new Buffer(exo_test_helper()->CreateGpuMemoryBuffer(buffer_size)));
+  std::unique_ptr<Surface> surface(new Surface);
+  std::unique_ptr<ShellSurface> shell_surface(
+      CreateDefaultShellSurface(surface.get()));
+
   surface->Attach(buffer.get());
   surface->Commit();
 
   gfx::Transform transform;
-  transform.Scale(1.0 / scale, 1.0 / scale);
+  if (IsClientBoundsMode())
+    transform.Scale(1.0 / scale, 1.0 / scale);
+
   EXPECT_EQ(
       transform.ToString(),
       shell_surface->host_window()->layer()->GetTargetTransform().ToString());

diff --git a/components/exo/wayland/server.cc b/components/exo/wayland/server.cc
index c42e332..8c483b3d 100644
--- a/components/exo/wayland/server.cc
+++ b/components/exo/wayland/server.cc

@@ -2280,6 +2280,17 @@
                        ? ZCR_REMOTE_SHELL_V1_LAYOUT_MODE_TABLET
                        : ZCR_REMOTE_SHELL_V1_LAYOUT_MODE_WINDOWED;
 
+    if (wl_resource_get_version(remote_shell_resource_) >= 8) {
+      float scale_factor =
+          WMHelper::GetInstance()->GetDefaultDeviceScaleFactor();
+      // Send using 16.16 fixed point.
+      const int kDecimalBits = 16;
+      int32_t fixed_scale =
+          static_cast<int32_t>(scale_factor * (1 << kDecimalBits));
+      zcr_remote_shell_v1_send_default_device_scale_factor(
+          remote_shell_resource_, fixed_scale);
+    }
+
     SendDisplayMetrics();
     SendActivated(helper->GetActiveWindow(), nullptr);
   }
@@ -2294,9 +2305,12 @@
     return wl_resource_get_version(remote_shell_resource_) >= 5;
   }
 
-  std::unique_ptr<ShellSurface> CreateShellSurface(Surface* surface,
-                                                   int container) {
-    return display_->CreateRemoteShellSurface(surface, container);
+  std::unique_ptr<ShellSurface> CreateShellSurface(
+      Surface* surface,
+      int container,
+      bool scale_by_default_device_scale_factor) {
+    return display_->CreateRemoteShellSurface(
+        surface, container, scale_by_default_device_scale_factor);
   }
 
   std::unique_ptr<NotificationSurface> CreateNotificationSurface(
@@ -2541,8 +2555,11 @@
                                      wl_resource* surface,
                                      uint32_t container) {
   WaylandRemoteShell* shell = GetUserDataAs<WaylandRemoteShell>(resource);
+  bool scale_by_default_scale_factor = wl_resource_get_version(resource) >= 8;
+
   std::unique_ptr<ShellSurface> shell_surface = shell->CreateShellSurface(
-      GetUserDataAs<Surface>(surface), RemoteSurfaceContainer(container));
+      GetUserDataAs<Surface>(surface), RemoteSurfaceContainer(container),
+      scale_by_default_scale_factor);
   if (!shell_surface) {
     wl_resource_post_error(resource, ZCR_REMOTE_SHELL_V1_ERROR_ROLE,
                            "surface has already been assigned a role");
@@ -2602,7 +2619,7 @@
     remote_shell_destroy, remote_shell_get_remote_surface,
     remote_shell_get_notification_surface};
 
-const uint32_t remote_shell_version = 7;
+const uint32_t remote_shell_version = 8;
 
 void bind_remote_shell(wl_client* client,
                        void* data,

diff --git a/components/exo/wm_helper.h b/components/exo/wm_helper.h
index 025d9f4..69d72cf 100644
--- a/components/exo/wm_helper.h
+++ b/components/exo/wm_helper.h

@@ -131,6 +131,7 @@
   virtual void AddPostTargetHandler(ui::EventHandler* handler) = 0;
   virtual void RemovePostTargetHandler(ui::EventHandler* handler) = 0;
   virtual bool IsTabletModeWindowManagerEnabled() const = 0;
+  virtual double GetDefaultDeviceScaleFactor() const = 0;
 
   // Overridden from aura::client::DragDropDelegate:
   void OnDragEntered(const ui::DropTargetEvent& event) override;

diff --git a/components/exo/wm_helper_ash.cc b/components/exo/wm_helper_ash.cc
index 1d4caa1..3a6cd897 100644
--- a/components/exo/wm_helper_ash.cc
+++ b/components/exo/wm_helper_ash.cc

@@ -112,6 +112,26 @@
       ->IsTabletModeWindowManagerEnabled();
 }
 
+double WMHelperAsh::GetDefaultDeviceScaleFactor() const {
+  if (!display::Display::HasInternalDisplay())
+    return 1.0;
+
+  if (display::Display::HasForceDeviceScaleFactor())
+    return display::Display::GetForcedDeviceScaleFactor();
+
+  display::DisplayManager* display_manager =
+      ash::Shell::Get()->display_manager();
+  const display::ManagedDisplayInfo& display_info =
+      display_manager->GetDisplayInfo(display::Display::InternalDisplayId());
+  for (auto& mode : display_info.display_modes()) {
+    if (mode->is_default())
+      return mode->device_scale_factor();
+  }
+
+  NOTREACHED();
+  return 1.0f;
+}
+
 void WMHelperAsh::OnWindowActivated(
     wm::ActivationChangeObserver::ActivationReason reason,
     aura::Window* gained_active,

diff --git a/components/exo/wm_helper_ash.h b/components/exo/wm_helper_ash.h
index f557484..4a951b7 100644
--- a/components/exo/wm_helper_ash.h
+++ b/components/exo/wm_helper_ash.h

@@ -42,6 +42,7 @@
   void AddPostTargetHandler(ui::EventHandler* handler) override;
   void RemovePostTargetHandler(ui::EventHandler* handler) override;
   bool IsTabletModeWindowManagerEnabled() const override;
+  double GetDefaultDeviceScaleFactor() const override;
 
   // Overridden from wm::ActivationChangeObserver:
   void OnWindowActivated(wm::ActivationChangeObserver::ActivationReason reason,

diff --git a/components/exo/wm_helper_mus.cc b/components/exo/wm_helper_mus.cc
index 8f8e8c2e..678e2a8 100644
--- a/components/exo/wm_helper_mus.cc
+++ b/components/exo/wm_helper_mus.cc

@@ -95,6 +95,11 @@
   return false;
 }
 
+double WMHelperMus::GetDefaultDeviceScaleFactor() const {
+  NOTIMPLEMENTED();
+  return 1.0;
+}
+
 void WMHelperMus::OnActiveFocusClientChanged(
     aura::client::FocusClient* focus_client,
     aura::Window* focus_client_root) {

diff --git a/components/exo/wm_helper_mus.h b/components/exo/wm_helper_mus.h
index 820db7a..f883c12c 100644
--- a/components/exo/wm_helper_mus.h
+++ b/components/exo/wm_helper_mus.h

@@ -41,6 +41,7 @@
   void AddPostTargetHandler(ui::EventHandler* handler) override;
   void RemovePostTargetHandler(ui::EventHandler* handler) override;
   bool IsTabletModeWindowManagerEnabled() const override;
+  double GetDefaultDeviceScaleFactor() const override;
 
   // Overridden from aura::FocusSynchronizerObserver:
   void OnActiveFocusClientChanged(aura::client::FocusClient* focus_client,

diff --git a/components/metrics/leak_detector/call_stack_manager.cc b/components/metrics/leak_detector/call_stack_manager.cc
index dfebd3c7..afedeed 100644
--- a/components/metrics/leak_detector/call_stack_manager.cc
+++ b/components/metrics/leak_detector/call_stack_manager.cc

@@ -40,8 +40,7 @@
   temp.stack = const_cast<const void**>(stack);
   // This is the only place where the call stack's hash is computed. This value
   // can be reused in the created object to avoid further hash computation.
-  temp.hash =
-      base::Hash(reinterpret_cast<const char*>(stack), sizeof(*stack) * depth);
+  temp.hash = base::Hash(stack, sizeof(*stack) * depth);
 
   auto iter = call_stacks_.find(&temp);
   if (iter != call_stacks_.end())

diff --git a/components/metrics/leak_detector/leak_detector_impl.cc b/components/metrics/leak_detector/leak_detector_impl.cc
index 43bd0d24..5cfbb54 100644
--- a/components/metrics/leak_detector/leak_detector_impl.cc
+++ b/components/metrics/leak_detector/leak_detector_impl.cc

@@ -244,7 +244,7 @@
 LeakDetectorImpl::AllocSizeEntry::~AllocSizeEntry() {}
 
 size_t LeakDetectorImpl::AddressHash::operator()(uintptr_t addr) const {
-  return base::Hash(reinterpret_cast<const char*>(&addr), sizeof(addr));
+  return base::Hash(&addr, sizeof(addr));
 }
 
 uintptr_t LeakDetectorImpl::GetOffset(const void* ptr) const {

diff --git a/components/password_manager/core/browser/password_autofill_manager_unittest.cc b/components/password_manager/core/browser/password_autofill_manager_unittest.cc
index 9def6d1..1ead66f 100644
--- a/components/password_manager/core/browser/password_autofill_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_autofill_manager_unittest.cc

@@ -154,6 +154,16 @@
     }
   }
 
+  void SetManualFallbacksForFillingStandalone(bool enabled) {
+    if (enabled) {
+      scoped_feature_list_.InitAndEnableFeature(
+          password_manager::features::kEnableManualFallbacksFillingStandalone);
+    } else {
+      scoped_feature_list_.InitAndDisableFeature(
+          password_manager::features::kEnableManualFallbacksFillingStandalone);
+    }
+  }
+
   static bool IsManualFallbackForFillingEnabled() {
     return base::FeatureList::IsEnabled(
                password_manager::features::kEnableManualFallbacksFilling) &&
@@ -1105,7 +1115,7 @@
   base::string16 show_all_saved_row_text =
       l10n_util::GetStringUTF16(IDS_AUTOFILL_SHOW_ALL_SAVED_FALLBACK);
 
-  SetManualFallbacksForFilling(true);
+  SetManualFallbacksForFillingStandalone(true);
 
   EXPECT_CALL(
       *autofill_client,
@@ -1198,7 +1208,7 @@
   auto client = base::MakeUnique<TestPasswordManagerClient>();
   InitializePasswordAutofillManager(client.get(), nullptr);
 
-  SetManualFallbacksForFilling(true);
+  SetManualFallbacksForFillingStandalone(true);
 
   password_autofill_manager_->OnShowManualFallbackSuggestion(
       base::i18n::RIGHT_TO_LEFT, gfx::RectF());

diff --git a/components/password_manager/core/common/password_manager_features.cc b/components/password_manager/core/common/password_manager_features.cc
index f84366b..f9c1684 100644
--- a/components/password_manager/core/common/password_manager_features.cc
+++ b/components/password_manager/core/common/password_manager_features.cc

@@ -25,6 +25,11 @@
 const base::Feature kEnableManualFallbacksFilling = {
     "EnableManualFallbacksFilling", base::FEATURE_ENABLED_BY_DEFAULT};
 
+// Enable a standalone popup UI, which will allow the user to view all saved
+// passwords.
+const base::Feature kEnableManualFallbacksFillingStandalone = {
+    "EnableManualFallbacksFillingStandalone", base::FEATURE_ENABLED_BY_DEFAULT};
+
 // Enable that an omnibox icon is shown when the user types into a password
 // field. When the user clicks on the icon, a password save/update bubble is
 // shown.

diff --git a/components/password_manager/core/common/password_manager_features.h b/components/password_manager/core/common/password_manager_features.h
index 96cc8f43..11c4d80 100644
--- a/components/password_manager/core/common/password_manager_features.h
+++ b/components/password_manager/core/common/password_manager_features.h

@@ -20,6 +20,7 @@
 extern const base::Feature kAffiliationBasedMatching;
 extern const base::Feature kDropSyncCredential;
 extern const base::Feature kEnableManualFallbacksFilling;
+extern const base::Feature kEnableManualFallbacksFillingStandalone;
 extern const base::Feature kEnableManualPasswordGeneration;
 extern const base::Feature kEnableManualSaving;
 extern const base::Feature kEnablePasswordForceSaving;

diff --git a/components/payments/content/BUILD.gn b/components/payments/content/BUILD.gn
index e7ea851..b031ee98 100644
--- a/components/payments/content/BUILD.gn
+++ b/components/payments/content/BUILD.gn

@@ -8,6 +8,8 @@
     "can_make_payment_query_factory.h",
     "payment_request.cc",
     "payment_request.h",
+    "payment_request_converter.cc",
+    "payment_request_converter.h",
     "payment_request_dialog.h",
     "payment_request_spec.cc",
     "payment_request_spec.h",
@@ -39,8 +41,6 @@
   sources = [
     "origin_security_checker.cc",
     "origin_security_checker.h",
-    "payment_details_validation.cc",
-    "payment_details_validation.h",
     "payment_manifest_parser_host.cc",
     "payment_manifest_parser_host.h",
   ]

diff --git a/components/payments/content/android/BUILD.gn b/components/payments/content/android/BUILD.gn
index 89dbeabf..49a2af3 100644
--- a/components/payments/content/android/BUILD.gn
+++ b/components/payments/content/android/BUILD.gn

@@ -19,6 +19,7 @@
   deps = [
     ":jni_headers",
     "//base",
+    "//components/payments/content",
     "//components/payments/content:utils",
     "//components/payments/core",
     "//content/public/browser",

diff --git a/components/payments/content/android/java/src/org/chromium/components/payments/PaymentValidator.java b/components/payments/content/android/java/src/org/chromium/components/payments/PaymentValidator.java
index c725cfa..b9c2e47 100644
--- a/components/payments/content/android/java/src/org/chromium/components/payments/PaymentValidator.java
+++ b/components/payments/content/android/java/src/org/chromium/components/payments/PaymentValidator.java

@@ -18,8 +18,8 @@
         if (details == null) {
             return false;
         }
-        return nativeValidatePaymentDetails(details.serialize());
+        return nativeValidatePaymentDetailsAndroid(details.serialize());
     }
 
-    private static native boolean nativeValidatePaymentDetails(ByteBuffer buffer);
+    private static native boolean nativeValidatePaymentDetailsAndroid(ByteBuffer buffer);
 };

diff --git a/components/payments/content/android/payment_details_validation_android.cc b/components/payments/content/android/payment_details_validation_android.cc
index 7378c09..b45762d 100644
--- a/components/payments/content/android/payment_details_validation_android.cc
+++ b/components/payments/content/android/payment_details_validation_android.cc

@@ -10,13 +10,15 @@
 #include <vector>
 
 #include "base/android/jni_android.h"
-#include "components/payments/content/payment_details_validation.h"
+#include "components/payments/content/payment_request_converter.h"
+#include "components/payments/core/payment_details.h"
+#include "components/payments/core/payment_details_validation.h"
 #include "jni/PaymentValidator_jni.h"
 #include "third_party/WebKit/public/platform/modules/payments/payment_request.mojom.h"
 
 namespace payments {
 
-jboolean ValidatePaymentDetails(
+jboolean ValidatePaymentDetailsAndroid(
     JNIEnv* env,
     const base::android::JavaParamRef<jclass>& jcaller,
     const base::android::JavaParamRef<jobject>& buffer) {
@@ -28,7 +30,8 @@
   if (!mojom::PaymentDetails::Deserialize(std::move(mojo_buffer), &details))
     return false;
   std::string unused_error_message;
-  return validatePaymentDetails(details, &unused_error_message);
+  return ValidatePaymentDetails(ConvertPaymentDetails(details),
+                                &unused_error_message);
 }
 
 }  // namespace payments

diff --git a/components/payments/content/payment_details_validation.cc b/components/payments/content/payment_details_validation.cc
deleted file mode 100644
index 9e92682a9..0000000
--- a/components/payments/content/payment_details_validation.cc
+++ /dev/null

@@ -1,168 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/payments/content/payment_details_validation.h"
-
-#include <set>
-#include <vector>
-
-#include "components/payments/core/payments_validators.h"
-#include "third_party/WebKit/public/platform/modules/payments/payment_request.mojom.h"
-
-namespace payments {
-namespace {
-
-// Validates ShippingOption or PaymentItem, which happen to have identical
-// fields, except for "id", which is present only in ShippingOption.
-template <typename T>
-bool validateShippingOptionOrPaymentItem(
-    const T& item,
-    const payments::mojom::PaymentItemPtr& total,
-    std::string* error_message) {
-  if (!item->amount) {
-    *error_message = "Currency amount required";
-    return false;
-  }
-
-  if (item->amount->currency.empty()) {
-    *error_message = "Currency code required";
-    return false;
-  }
-
-  if (item->amount->value.empty()) {
-    *error_message = "Currency value required";
-    return false;
-  }
-
-  if (item->amount->currency_system.empty()) {
-    *error_message = "Currency system can't be empty";
-    return false;
-  }
-
-  if (!payments::PaymentsValidators::IsValidCurrencyCodeFormat(
-          item->amount->currency, item->amount->currency_system,
-          error_message)) {
-    return false;
-  }
-
-  if (!payments::PaymentsValidators::IsValidAmountFormat(item->amount->value,
-                                                         error_message)) {
-    return false;
-  }
-  return true;
-}
-
-bool validateDisplayItems(
-    const std::vector<payments::mojom::PaymentItemPtr>& items,
-    const payments::mojom::PaymentItemPtr& total,
-    std::string* error_message) {
-  for (const auto& item : items) {
-    if (!validateShippingOptionOrPaymentItem(item, total, error_message))
-      return false;
-  }
-  return true;
-}
-
-bool validateShippingOptions(
-    const std::vector<payments::mojom::PaymentShippingOptionPtr>& options,
-    const payments::mojom::PaymentItemPtr& total,
-    std::string* error_message) {
-  std::set<std::string> uniqueIds;
-  for (const auto& option : options) {
-    if (option->id.empty()) {
-      *error_message = "ShippingOption id required";
-      return false;
-    }
-
-    if (uniqueIds.find(option->id) != uniqueIds.end()) {
-      *error_message = "Duplicate shipping option identifiers are not allowed";
-      return false;
-    }
-    uniqueIds.insert(option->id);
-
-    if (!validateShippingOptionOrPaymentItem(option, total, error_message))
-      return false;
-  }
-  return true;
-}
-
-bool validatePaymentDetailsModifiers(
-    const std::vector<payments::mojom::PaymentDetailsModifierPtr>& modifiers,
-    const payments::mojom::PaymentItemPtr& total,
-    std::string* error_message) {
-  if (modifiers.empty()) {
-    *error_message = "Must specify at least one payment details modifier";
-    return false;
-  }
-
-  for (const auto& modifier : modifiers) {
-    if (!modifier->method_data) {
-      *error_message = "Method data required";
-      return false;
-    }
-
-    if (modifier->method_data->supported_methods.empty()) {
-      *error_message = "Must specify at least one payment method identifier";
-      return false;
-    }
-
-    if (modifier->total) {
-      if (!validateShippingOptionOrPaymentItem(modifier->total, total,
-                                               error_message))
-        return false;
-
-      if (modifier->total->amount->value[0] == '-') {
-        *error_message = "Total amount value should be non-negative";
-        return false;
-      }
-    }
-
-    if (modifier->additional_display_items.size()) {
-      if (!validateDisplayItems(modifier->additional_display_items, total,
-                                error_message)) {
-        return false;
-      }
-    }
-  }
-  return true;
-}
-
-}  // namespace
-
-bool validatePaymentDetails(const mojom::PaymentDetailsPtr& details,
-                            std::string* error_message) {
-  if (details->total) {
-    if (!validateShippingOptionOrPaymentItem(details->total, details->total,
-                                             error_message))
-      return false;
-
-    if (details->total->amount->value[0] == '-') {
-      *error_message = "Total amount value should be non-negative";
-      return false;
-    }
-  }
-
-  if (details->display_items.size()) {
-    if (!validateDisplayItems(details->display_items, details->total,
-                              error_message))
-      return false;
-  }
-
-  if (details->shipping_options.size()) {
-    if (!validateShippingOptions(details->shipping_options, details->total,
-                                 error_message))
-      return false;
-  }
-
-  if (details->modifiers.size()) {
-    if (!validatePaymentDetailsModifiers(details->modifiers, details->total,
-                                         error_message))
-      return false;
-  }
-  if (!PaymentsValidators::IsValidErrorMsgFormat(details->error, error_message))
-    return false;
-  return true;
-}
-
-}  // namespace payments

diff --git a/components/payments/content/payment_details_validation.h b/components/payments/content/payment_details_validation.h
deleted file mode 100644
index 358fa8e..0000000
--- a/components/payments/content/payment_details_validation.h
+++ /dev/null

@@ -1,19 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_PAYMENTS_CONTENT_PAYMENT_DETAILS_VALIDATION_H_
-#define COMPONENTS_PAYMENTS_CONTENT_PAYMENT_DETAILS_VALIDATION_H_
-
-#include <string>
-
-#include "third_party/WebKit/public/platform/modules/payments/payment_request.mojom.h"
-
-namespace payments {
-
-bool validatePaymentDetails(const mojom::PaymentDetailsPtr& details,
-                            std::string* error_message);
-
-}  // namespace payments
-
-#endif  // COMPONENTS_PAYMENTS_CONTENT_PAYMENT_DETAILS_VALIDATION_H_

diff --git a/components/payments/content/payment_request.cc b/components/payments/content/payment_request.cc
index 342e457..b887d66a 100644
--- a/components/payments/content/payment_request.cc
+++ b/components/payments/content/payment_request.cc

@@ -11,9 +11,11 @@
 #include "base/stl_util.h"
 #include "components/payments/content/can_make_payment_query_factory.h"
 #include "components/payments/content/origin_security_checker.h"
-#include "components/payments/content/payment_details_validation.h"
+#include "components/payments/content/payment_request_converter.h"
 #include "components/payments/content/payment_request_web_contents_manager.h"
 #include "components/payments/core/can_make_payment_query.h"
+#include "components/payments/core/payment_details.h"
+#include "components/payments/core/payment_details_validation.h"
 #include "components/payments/core/payment_prefs.h"
 #include "components/prefs/pref_service.h"
 #include "components/url_formatter/elide_url.h"
@@ -96,7 +98,7 @@
   }
 
   std::string error;
-  if (!validatePaymentDetails(details, &error)) {
+  if (!ValidatePaymentDetails(ConvertPaymentDetails(details), &error)) {
     LOG(ERROR) << error;
     OnConnectionTerminated();
     return;
@@ -174,7 +176,7 @@
 
 void PaymentRequest::UpdateWith(mojom::PaymentDetailsPtr details) {
   std::string error;
-  if (!validatePaymentDetails(details, &error)) {
+  if (!ValidatePaymentDetails(ConvertPaymentDetails(details), &error)) {
     LOG(ERROR) << error;
     OnConnectionTerminated();
     return;

diff --git a/components/payments/content/payment_request_converter.cc b/components/payments/content/payment_request_converter.cc
new file mode 100644
index 0000000..f356eb5
--- /dev/null
+++ b/components/payments/content/payment_request_converter.cc

@@ -0,0 +1,159 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/payments/content/payment_request_converter.h"
+
+#include <memory>
+
+#include "base/memory/ptr_util.h"
+#include "components/autofill/core/browser/credit_card.h"
+#include "components/payments/core/payment_currency_amount.h"
+#include "components/payments/core/payment_details.h"
+#include "components/payments/core/payment_details_modifier.h"
+#include "components/payments/core/payment_item.h"
+#include "components/payments/core/payment_method_data.h"
+#include "components/payments/core/payment_shipping_option.h"
+
+namespace payments {
+namespace {
+
+// Returns the card type associated with the given BasicCardType.
+autofill::CreditCard::CardType GetBasicCardType(
+    const mojom::BasicCardType& type) {
+  switch (type) {
+    case mojom::BasicCardType::CREDIT:
+      return autofill::CreditCard::CARD_TYPE_CREDIT;
+    case mojom::BasicCardType::DEBIT:
+      return autofill::CreditCard::CARD_TYPE_DEBIT;
+    case mojom::BasicCardType::PREPAID:
+      return autofill::CreditCard::CARD_TYPE_PREPAID;
+  }
+  NOTREACHED();
+  return autofill::CreditCard::CARD_TYPE_UNKNOWN;
+}
+
+// Returns the card network name associated with a given BasicCardNetwork. Names
+// are inspired by https://www.w3.org/Payments/card-network-ids.
+std::string GetBasicCardNetworkName(const mojom::BasicCardNetwork& network) {
+  switch (network) {
+    case mojom::BasicCardNetwork::AMEX:
+      return "amex";
+    case mojom::BasicCardNetwork::DINERS:
+      return "diners";
+    case mojom::BasicCardNetwork::DISCOVER:
+      return "discover";
+    case mojom::BasicCardNetwork::JCB:
+      return "jcb";
+    case mojom::BasicCardNetwork::MASTERCARD:
+      return "mastercard";
+    case mojom::BasicCardNetwork::MIR:
+      return "mir";
+    case mojom::BasicCardNetwork::UNIONPAY:
+      return "unionpay";
+    case mojom::BasicCardNetwork::VISA:
+      return "visa";
+  }
+  NOTREACHED();
+  return std::string();
+}
+
+PaymentCurrencyAmount ConvertPaymentCurrencyAmount(
+    const mojom::PaymentCurrencyAmountPtr& amount_entry) {
+  PaymentCurrencyAmount amount;
+  amount.currency = amount_entry->currency;
+  amount.value = amount_entry->value;
+  amount.currency_system = amount_entry->currency_system;
+  return amount;
+}
+
+PaymentItem ConvertPaymentItem(const mojom::PaymentItemPtr& item_entry) {
+  PaymentItem item;
+  item.label = item_entry->label;
+  if (item_entry->amount)
+    item.amount = ConvertPaymentCurrencyAmount(item_entry->amount);
+  item.pending = item_entry->pending;
+  return item;
+}
+
+PaymentDetailsModifier ConvertPaymentDetailsModifier(
+    const mojom::PaymentDetailsModifierPtr& modifier_entry) {
+  PaymentDetailsModifier modifier;
+  if (modifier_entry->total) {
+    modifier.total = base::MakeUnique<PaymentItem>(
+        ConvertPaymentItem(modifier_entry->total));
+  }
+  modifier.additional_display_items.reserve(
+      modifier_entry->additional_display_items.size());
+  for (const mojom::PaymentItemPtr& additional_display_item :
+       modifier_entry->additional_display_items) {
+    modifier.additional_display_items.push_back(
+        ConvertPaymentItem(additional_display_item));
+  }
+  if (modifier_entry->method_data)
+    modifier.method_data =
+        ConvertPaymentMethodData(modifier_entry->method_data);
+  return modifier;
+}
+
+PaymentShippingOption ConvertPaymentShippingOption(
+    const mojom::PaymentShippingOptionPtr& option_entry) {
+  PaymentShippingOption option;
+  option.id = option_entry->id;
+  option.label = option_entry->label;
+  if (option_entry->amount)
+    option.amount = ConvertPaymentCurrencyAmount(option_entry->amount);
+  option.selected = option_entry->selected;
+  return option;
+}
+
+}  // namespace
+
+PaymentMethodData ConvertPaymentMethodData(
+    const mojom::PaymentMethodDataPtr& method_data_entry) {
+  PaymentMethodData method_data;
+  method_data.supported_methods = method_data_entry->supported_methods;
+
+  // Transfer the supported basic card networks (visa, amex) and types
+  // (credit, debit).
+  for (const mojom::BasicCardNetwork& network :
+       method_data_entry->supported_networks) {
+    method_data.supported_networks.push_back(GetBasicCardNetworkName(network));
+  }
+  for (const mojom::BasicCardType& type : method_data_entry->supported_types) {
+    autofill::CreditCard::CardType card_type = GetBasicCardType(type);
+    method_data.supported_types.insert(card_type);
+  }
+  return method_data;
+}
+
+PaymentDetails ConvertPaymentDetails(
+    const mojom::PaymentDetailsPtr& details_entry) {
+  PaymentDetails details;
+  if (details_entry->total) {
+    details.total =
+        base::MakeUnique<PaymentItem>(ConvertPaymentItem(details_entry->total));
+  }
+  details.display_items.reserve(details_entry->display_items.size());
+  for (const mojom::PaymentItemPtr& display_item :
+       details_entry->display_items) {
+    details.display_items.push_back(ConvertPaymentItem(display_item));
+  }
+  details.shipping_options.reserve(details_entry->shipping_options.size());
+  for (const mojom::PaymentShippingOptionPtr& shipping_option :
+       details_entry->shipping_options) {
+    details.shipping_options.push_back(
+        ConvertPaymentShippingOption(shipping_option));
+  }
+  details.modifiers.reserve(details_entry->modifiers.size());
+  for (const mojom::PaymentDetailsModifierPtr& modifier :
+       details_entry->modifiers) {
+    details.modifiers.push_back(ConvertPaymentDetailsModifier(modifier));
+  }
+  details.error = details_entry->error;
+  if (details_entry->id.has_value())
+    details.id = details_entry->id.value();
+  return details;
+}
+
+}  // namespace payments

diff --git a/components/payments/content/payment_request_converter.h b/components/payments/content/payment_request_converter.h
new file mode 100644
index 0000000..9f91697
--- /dev/null
+++ b/components/payments/content/payment_request_converter.h

@@ -0,0 +1,25 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_PAYMENTS_CONTENT_PAYMENT_REQUEST_CONVERTER_H_
+#define COMPONENTS_PAYMENTS_CONTENT_PAYMENT_REQUEST_CONVERTER_H_
+
+#include "third_party/WebKit/public/platform/modules/payments/payment_request.mojom.h"
+
+// TODO(crbug.com/760945): Write unit tests for these functions.
+
+namespace payments {
+
+class PaymentDetails;
+class PaymentMethodData;
+
+PaymentMethodData ConvertPaymentMethodData(
+    const mojom::PaymentMethodDataPtr& method_data_entry);
+
+PaymentDetails ConvertPaymentDetails(
+    const mojom::PaymentDetailsPtr& details_entry);
+
+}  // namespace payments
+
+#endif  // COMPONENTS_PAYMENTS_CONTENT_PAYMENT_REQUEST_CONVERTER_H_

diff --git a/components/payments/content/payment_request_spec.cc b/components/payments/content/payment_request_spec.cc
index e328318..37bf63e 100644
--- a/components/payments/content/payment_request_spec.cc
+++ b/components/payments/content/payment_request_spec.cc

@@ -9,6 +9,7 @@
 #include "base/feature_list.h"
 #include "base/logging.h"
 #include "base/strings/utf_string_conversions.h"
+#include "components/payments/content/payment_request_converter.h"
 #include "components/payments/core/features.h"
 #include "components/payments/core/payment_instrument.h"
 #include "components/payments/core/payment_method_data.h"
@@ -20,64 +21,6 @@
 
 namespace {
 
-// Returns the card network name associated with a given BasicCardNetwork. Names
-// are inspired by https://www.w3.org/Payments/card-network-ids.
-std::string GetBasicCardNetworkName(const mojom::BasicCardNetwork& network) {
-  switch (network) {
-    case mojom::BasicCardNetwork::AMEX:
-      return "amex";
-    case mojom::BasicCardNetwork::DINERS:
-      return "diners";
-    case mojom::BasicCardNetwork::DISCOVER:
-      return "discover";
-    case mojom::BasicCardNetwork::JCB:
-      return "jcb";
-    case mojom::BasicCardNetwork::MASTERCARD:
-      return "mastercard";
-    case mojom::BasicCardNetwork::MIR:
-      return "mir";
-    case mojom::BasicCardNetwork::UNIONPAY:
-      return "unionpay";
-    case mojom::BasicCardNetwork::VISA:
-      return "visa";
-  }
-  NOTREACHED();
-  return std::string();
-}
-
-// Returns the card type associated with the given BasicCardType.
-autofill::CreditCard::CardType GetBasicCardType(
-    const mojom::BasicCardType& type) {
-  switch (type) {
-    case mojom::BasicCardType::CREDIT:
-      return autofill::CreditCard::CARD_TYPE_CREDIT;
-    case mojom::BasicCardType::DEBIT:
-      return autofill::CreditCard::CARD_TYPE_DEBIT;
-    case mojom::BasicCardType::PREPAID:
-      return autofill::CreditCard::CARD_TYPE_PREPAID;
-  }
-  NOTREACHED();
-  return autofill::CreditCard::CARD_TYPE_UNKNOWN;
-}
-
-PaymentMethodData CreatePaymentMethodData(
-    const mojom::PaymentMethodDataPtr& method_data_entry) {
-  PaymentMethodData method_data;
-  method_data.supported_methods = method_data_entry->supported_methods;
-
-  // Transfer the supported basic card networks (visa, amex) and types
-  // (credit, debit).
-  for (const mojom::BasicCardNetwork& network :
-       method_data_entry->supported_networks) {
-    method_data.supported_networks.push_back(GetBasicCardNetworkName(network));
-  }
-  for (const mojom::BasicCardType& type : method_data_entry->supported_types) {
-    autofill::CreditCard::CardType card_type = GetBasicCardType(type);
-    method_data.supported_types.insert(card_type);
-  }
-  return method_data;
-}
-
 // Validates the |method_data| and fills |supported_card_networks_|,
 // |supported_card_networks_set_|, |basic_card_specified_networks_|,
 // and |url_payment_method_identifiers_|.
@@ -116,7 +59,7 @@
           method_data_entry->stringified_data);
     }
 
-    method_data_vector.push_back(CreatePaymentMethodData(method_data_entry));
+    method_data_vector.push_back(ConvertPaymentMethodData(method_data_entry));
   }
 
   PopulateValidatedMethodData(
@@ -280,7 +223,7 @@
     std::vector<GURL> url_payment_method_identifiers;
     std::map<std::string, std::set<std::string>> stringified_method_data;
     PopulateValidatedMethodData(
-        {CreatePaymentMethodData(modifier->method_data)}, &supported_networks,
+        {ConvertPaymentMethodData(modifier->method_data)}, &supported_networks,
         &basic_card_specified_networks, &supported_card_networks_set,
         &supported_types, &url_payment_method_identifiers,
         &stringified_method_data);

diff --git a/components/payments/core/BUILD.gn b/components/payments/core/BUILD.gn
index 8895c1b..0ab9b6a3 100644
--- a/components/payments/core/BUILD.gn
+++ b/components/payments/core/BUILD.gn

@@ -29,6 +29,8 @@
     "payment_details.h",
     "payment_details_modifier.cc",
     "payment_details_modifier.h",
+    "payment_details_validation.cc",
+    "payment_details_validation.h",
     "payment_instrument.cc",
     "payment_instrument.h",
     "payment_item.cc",

diff --git a/components/payments/core/payment_details_validation.cc b/components/payments/core/payment_details_validation.cc
new file mode 100644
index 0000000..4cc8b42
--- /dev/null
+++ b/components/payments/core/payment_details_validation.cc

@@ -0,0 +1,155 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/payments/core/payment_details_validation.h"
+
+#include <set>
+#include <vector>
+
+#include "components/payments/core/payment_details.h"
+#include "components/payments/core/payments_validators.h"
+
+namespace payments {
+namespace {
+
+// Validates ShippingOption or PaymentItem, which happen to have identical
+// fields, except for "id", which is present only in ShippingOption.
+template <typename T>
+bool ValidateShippingOptionOrPaymentItem(const T& item,
+                                         const PaymentItem& total,
+                                         std::string* error_message) {
+  if (item.amount.currency.empty()) {
+    *error_message = "Currency code required";
+    return false;
+  }
+
+  if (item.amount.value.empty()) {
+    *error_message = "Currency value required";
+    return false;
+  }
+
+  if (item.amount.currency_system.empty()) {
+    *error_message = "Currency system can't be empty";
+    return false;
+  }
+
+  if (!payments::PaymentsValidators::IsValidCurrencyCodeFormat(
+          item.amount.currency, item.amount.currency_system, error_message)) {
+    return false;
+  }
+
+  if (!payments::PaymentsValidators::IsValidAmountFormat(item.amount.value,
+                                                         error_message)) {
+    return false;
+  }
+  return true;
+}
+
+bool ValidateDisplayItems(const std::vector<PaymentItem>& items,
+                          const PaymentItem& total,
+                          std::string* error_message) {
+  for (const auto& item : items) {
+    if (!ValidateShippingOptionOrPaymentItem(item, total, error_message))
+      return false;
+  }
+  return true;
+}
+
+bool ValidateShippingOptions(const std::vector<PaymentShippingOption>& options,
+                             const PaymentItem& total,
+                             std::string* error_message) {
+  std::set<std::string> uniqueIds;
+  for (const auto& option : options) {
+    if (option.id.empty()) {
+      *error_message = "ShippingOption id required";
+      return false;
+    }
+
+    if (uniqueIds.find(option.id) != uniqueIds.end()) {
+      *error_message = "Duplicate shipping option identifiers are not allowed";
+      return false;
+    }
+    uniqueIds.insert(option.id);
+
+    if (!ValidateShippingOptionOrPaymentItem(option, total, error_message))
+      return false;
+  }
+  return true;
+}
+
+bool ValidatePaymentDetailsModifiers(
+    const std::vector<PaymentDetailsModifier>& modifiers,
+    const PaymentItem& total,
+    std::string* error_message) {
+  if (modifiers.empty()) {
+    *error_message = "Must specify at least one payment details modifier";
+    return false;
+  }
+
+  for (const auto& modifier : modifiers) {
+    if (modifier.method_data.supported_methods.empty()) {
+      *error_message = "Must specify at least one payment method identifier";
+      return false;
+    }
+
+    if (modifier.total) {
+      if (!ValidateShippingOptionOrPaymentItem(*modifier.total, total,
+                                               error_message))
+        return false;
+
+      if (modifier.total->amount.value[0] == '-') {
+        *error_message = "Total amount value should be non-negative";
+        return false;
+      }
+    }
+
+    if (modifier.additional_display_items.size()) {
+      if (!ValidateDisplayItems(modifier.additional_display_items, total,
+                                error_message)) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+
+}  // namespace
+
+bool ValidatePaymentDetails(const PaymentDetails& details,
+                            std::string* error_message) {
+  if (details.total) {
+    if (!ValidateShippingOptionOrPaymentItem(*details.total, *details.total,
+                                             error_message)) {
+      return false;
+    }
+
+    if (details.total->amount.value[0] == '-') {
+      *error_message = "Total amount value should be non-negative";
+      return false;
+    }
+  }
+
+  if (details.display_items.size()) {
+    if (!ValidateDisplayItems(details.display_items, *details.total,
+                              error_message))
+      return false;
+  }
+
+  if (details.shipping_options.size()) {
+    if (!ValidateShippingOptions(details.shipping_options, *details.total,
+                                 error_message))
+      return false;
+  }
+
+  if (details.modifiers.size()) {
+    if (!ValidatePaymentDetailsModifiers(details.modifiers, *details.total,
+                                         error_message))
+      return false;
+  }
+  if (!PaymentsValidators::IsValidErrorMsgFormat(details.error, error_message))
+    return false;
+  return true;
+}
+
+}  // namespace payments

diff --git a/components/payments/core/payment_details_validation.h b/components/payments/core/payment_details_validation.h
new file mode 100644
index 0000000..f6021c62
--- /dev/null
+++ b/components/payments/core/payment_details_validation.h

@@ -0,0 +1,21 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_PAYMENTS_CORE_PAYMENT_DETAILS_VALIDATION_H_
+#define COMPONENTS_PAYMENTS_CORE_PAYMENT_DETAILS_VALIDATION_H_
+
+#include <string>
+
+// TODO(crbug.com/760946): Write unit tests for this function.
+
+namespace payments {
+
+class PaymentDetails;
+
+bool ValidatePaymentDetails(const PaymentDetails& details,
+                            std::string* error_message);
+
+}  // namespace payments
+
+#endif  // COMPONENTS_PAYMENTS_CORE_PAYMENT_DETAILS_VALIDATION_H_

diff --git a/components/payments/core/payments_profile_comparator.h b/components/payments/core/payments_profile_comparator.h
index 38d4332..f7b7ea98 100644
--- a/components/payments/core/payments_profile_comparator.h
+++ b/components/payments/core/payments_profile_comparator.h

@@ -40,7 +40,7 @@
 
   PaymentsProfileComparator(const std::string& app_locale,
                             const PaymentOptionsProvider& options);
-  ~PaymentsProfileComparator();
+  virtual ~PaymentsProfileComparator();
 
   // Returns a bitmask indicating which fields (or groups of fields) on this
   // profile are not complete and valid.

diff --git a/components/safe_browsing/DEPS b/components/safe_browsing/DEPS
index aa87f2c..227ca28 100644
--- a/components/safe_browsing/DEPS
+++ b/components/safe_browsing/DEPS

@@ -8,6 +8,7 @@
   "+google_apis",
   "+mojo/public/cpp",
   "+net/base",
+  "+net/http",
   "+net/log",
   "+net/traffic_annotation",
   "+net/url_request",

diff --git a/components/safe_browsing/browser/base_parallel_resource_throttle.cc b/components/safe_browsing/browser/base_parallel_resource_throttle.cc
index a59be63c..58399344 100644
--- a/components/safe_browsing/browser/base_parallel_resource_throttle.cc
+++ b/components/safe_browsing/browser/base_parallel_resource_throttle.cc

@@ -48,8 +48,8 @@
 
   net::HttpRequestHeaders full_headers;
   resource_request.headers = request_->GetFullRequestHeaders(&full_headers)
-                                 ? full_headers.ToString()
-                                 : request_->extra_request_headers().ToString();
+                                 ? full_headers
+                                 : request_->extra_request_headers();
 
   resource_request.load_flags = request_->load_flags();
   resource_request.resource_type = resource_type_;

diff --git a/components/safe_browsing/browser/mojo_safe_browsing_impl.cc b/components/safe_browsing/browser/mojo_safe_browsing_impl.cc
index c613b93a..b367088 100644
--- a/components/safe_browsing/browser/mojo_safe_browsing_impl.cc
+++ b/components/safe_browsing/browser/mojo_safe_browsing_impl.cc

@@ -55,7 +55,12 @@
 MojoSafeBrowsingImpl::MojoSafeBrowsingImpl(
     scoped_refptr<UrlCheckerDelegate> delegate,
     int render_process_id)
-    : delegate_(std::move(delegate)), render_process_id_(render_process_id) {}
+    : delegate_(std::move(delegate)), render_process_id_(render_process_id) {
+  // It is safe to bind |this| as Unretained because |bindings_| is owned by
+  // |this| and will not call this callback after it is destroyed.
+  bindings_.set_connection_error_handler(base::Bind(
+      &MojoSafeBrowsingImpl::OnConnectionError, base::Unretained(this)));
+}
 
 MojoSafeBrowsingImpl::~MojoSafeBrowsingImpl() {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
@@ -73,9 +78,9 @@
   if (!delegate || !delegate->GetDatabaseManager()->IsSupported())
     return;
 
-  mojo::MakeStrongBinding(base::WrapUnique(new MojoSafeBrowsingImpl(
-                              std::move(delegate), render_process_id)),
-                          std::move(request));
+  auto* impl = new MojoSafeBrowsingImpl(std::move(delegate), render_process_id);
+  impl->Clone(std::move(request));
+  // |impl| will be freed when there are no more pipes bound to it.
 }
 
 void MojoSafeBrowsingImpl::CreateCheckerAndCheck(
@@ -83,7 +88,7 @@
     mojom::SafeBrowsingUrlCheckerRequest request,
     const GURL& url,
     const std::string& method,
-    const std::string& headers,
+    const net::HttpRequestHeaders& headers,
     int32_t load_flags,
     content::ResourceType resource_type,
     bool has_user_gesture,
@@ -103,4 +108,13 @@
   mojo::MakeStrongBinding(std::move(checker_impl), std::move(request));
 }
 
+void MojoSafeBrowsingImpl::Clone(mojom::SafeBrowsingRequest request) {
+  bindings_.AddBinding(this, std::move(request));
+}
+
+void MojoSafeBrowsingImpl::OnConnectionError() {
+  if (bindings_.empty())
+    delete this;
+}
+
 }  // namespace safe_browsing

diff --git a/components/safe_browsing/browser/mojo_safe_browsing_impl.h b/components/safe_browsing/browser/mojo_safe_browsing_impl.h
index 8e423f5..e246f62 100644
--- a/components/safe_browsing/browser/mojo_safe_browsing_impl.h
+++ b/components/safe_browsing/browser/mojo_safe_browsing_impl.h

@@ -10,6 +10,7 @@
 #include "components/safe_browsing/browser/url_checker_delegate.h"
 #include "components/safe_browsing/common/safe_browsing.mojom.h"
 #include "ipc/ipc_message.h"
+#include "mojo/public/cpp/bindings/binding_set.h"
 
 namespace safe_browsing {
 
@@ -33,12 +34,16 @@
                              mojom::SafeBrowsingUrlCheckerRequest request,
                              const GURL& url,
                              const std::string& method,
-                             const std::string& headers,
+                             const net::HttpRequestHeaders& headers,
                              int32_t load_flags,
                              content::ResourceType resource_type,
                              bool has_user_gesture,
                              CreateCheckerAndCheckCallback callback) override;
+  void Clone(mojom::SafeBrowsingRequest request) override;
 
+  void OnConnectionError();
+
+  mojo::BindingSet<mojom::SafeBrowsing> bindings_;
   scoped_refptr<UrlCheckerDelegate> delegate_;
   int render_process_id_ = MSG_ROUTING_NONE;
 

diff --git a/components/safe_browsing/browser/safe_browsing_url_checker_impl.cc b/components/safe_browsing/browser/safe_browsing_url_checker_impl.cc
index 35387807..38fce0a 100644
--- a/components/safe_browsing/browser/safe_browsing_url_checker_impl.cc
+++ b/components/safe_browsing/browser/safe_browsing_url_checker_impl.cc

@@ -37,7 +37,7 @@
 SafeBrowsingUrlCheckerImpl::UrlInfo::~UrlInfo() = default;
 
 SafeBrowsingUrlCheckerImpl::SafeBrowsingUrlCheckerImpl(
-    const std::string& headers,
+    const net::HttpRequestHeaders& headers,
     int load_flags,
     content::ResourceType resource_type,
     bool has_user_gesture,
@@ -142,12 +142,9 @@
   resource.web_contents_getter = web_contents_getter_;
   resource.threat_source = database_manager_->GetThreatSource();
 
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(headers_);
-
   state_ = STATE_DISPLAYING_BLOCKING_PAGE;
   url_checker_delegate_->StartDisplayingBlockingPageHelper(
-      resource, urls_[next_index_].method, headers,
+      resource, urls_[next_index_].method, headers_,
       resource_type_ == content::RESOURCE_TYPE_MAIN_FRAME, has_user_gesture_);
 }
 

diff --git a/components/safe_browsing/browser/safe_browsing_url_checker_impl.h b/components/safe_browsing/browser/safe_browsing_url_checker_impl.h
index 83328e6..d46949f 100644
--- a/components/safe_browsing/browser/safe_browsing_url_checker_impl.h
+++ b/components/safe_browsing/browser/safe_browsing_url_checker_impl.h

@@ -14,6 +14,7 @@
 #include "components/safe_browsing/common/safe_browsing.mojom.h"
 #include "components/safe_browsing_db/database_manager.h"
 #include "content/public/common/resource_type.h"
+#include "net/http/http_request_headers.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -34,7 +35,7 @@
                                    public SafeBrowsingDatabaseManager::Client {
  public:
   SafeBrowsingUrlCheckerImpl(
-      const std::string& headers,
+      const net::HttpRequestHeaders& headers,
       int load_flags,
       content::ResourceType resource_type,
       bool has_user_gesture,
@@ -102,7 +103,7 @@
     CheckUrlCallback callback;
   };
 
-  const std::string headers_;
+  const net::HttpRequestHeaders headers_;
   const int load_flags_;
   const content::ResourceType resource_type_;
   const bool has_user_gesture_;

diff --git a/components/safe_browsing/common/BUILD.gn b/components/safe_browsing/common/BUILD.gn
index 6de5638..7fc71ce 100644
--- a/components/safe_browsing/common/BUILD.gn
+++ b/components/safe_browsing/common/BUILD.gn

@@ -63,6 +63,7 @@
 
   public_deps = [
     "//content/public/common:resource_type_bindings",
+    "//services/network/public/interfaces",
     "//url/mojo:url_mojom_gurl",
   ]
 }

diff --git a/components/safe_browsing/common/safe_browsing.mojom b/components/safe_browsing/common/safe_browsing.mojom
index ee79cb2..a5949259 100644
--- a/components/safe_browsing/common/safe_browsing.mojom
+++ b/components/safe_browsing/common/safe_browsing.mojom

@@ -5,6 +5,7 @@
 module safe_browsing.mojom;
 
 import "content/public/common/resource_type.mojom";
+import "services/network/public/interfaces/http_request_headers.mojom";
 import "url/mojo/url.mojom";
 
 // Provided by the browser and used by renderers to perform SafeBrowsing URL
@@ -32,10 +33,13 @@
       SafeBrowsingUrlChecker& request,
       url.mojom.Url url,
       string method,
-      string headers,
+      network.mojom.HttpRequestHeaders headers,
       int32 load_flags,
       content.mojom.ResourceType resource_type,
       bool has_user_gesture) => (bool proceed, bool showed_interstitial);
+
+  // Bind an additional pipe to this instance of the SafeBrowsing interface.
+  Clone(SafeBrowsing& request);
 };
 
 interface SafeBrowsingUrlChecker {

diff --git a/components/safe_browsing/renderer/renderer_url_loader_throttle.cc b/components/safe_browsing/renderer/renderer_url_loader_throttle.cc
index 32af0628..c933b3a 100644
--- a/components/safe_browsing/renderer/renderer_url_loader_throttle.cc
+++ b/components/safe_browsing/renderer/renderer_url_loader_throttle.cc

@@ -21,6 +21,13 @@
 
 RendererURLLoaderThrottle::~RendererURLLoaderThrottle() = default;
 
+void RendererURLLoaderThrottle::DetachFromCurrentSequence() {
+  // Create a new pipe to the SafeBrowsing interface that can be bound to a
+  // different sequence.
+  safe_browsing_->Clone(mojo::MakeRequest(&safe_browsing_ptr_info_));
+  safe_browsing_ = nullptr;
+}
+
 void RendererURLLoaderThrottle::WillStartRequest(
     const content::ResourceRequest& request,
     bool* defer) {
@@ -28,13 +35,22 @@
   DCHECK(!blocked_);
   DCHECK(!url_checker_);
 
+  if (safe_browsing_ptr_info_.is_valid()) {
+    // Bind the pipe created in DetachFromCurrentSequence to the current
+    // sequence.
+    safe_browsing_ptr_.Bind(std::move(safe_browsing_ptr_info_));
+    safe_browsing_ = safe_browsing_ptr_.get();
+  }
+
   pending_checks_++;
-  // Use a weak pointer to self because |safe_browsing_| is not owned by this
-  // object.
+  // Use a weak pointer to self because |safe_browsing_| may not be owned by
+  // this object.
+  net::HttpRequestHeaders headers;
+  headers.CopyFrom(request.headers);
   safe_browsing_->CreateCheckerAndCheck(
       render_frame_id_, mojo::MakeRequest(&url_checker_), request.url,
-      request.method, request.headers, request.load_flags,
-      request.resource_type, request.has_user_gesture,
+      request.method, headers, request.load_flags, request.resource_type,
+      request.has_user_gesture,
       base::BindOnce(&RendererURLLoaderThrottle::OnCheckUrlResult,
                      weak_factory_.GetWeakPtr()));
   safe_browsing_ = nullptr;

diff --git a/components/safe_browsing/renderer/renderer_url_loader_throttle.h b/components/safe_browsing/renderer/renderer_url_loader_throttle.h
index 9f64297d..86d09f3 100644
--- a/components/safe_browsing/renderer/renderer_url_loader_throttle.h
+++ b/components/safe_browsing/renderer/renderer_url_loader_throttle.h

@@ -25,6 +25,7 @@
   ~RendererURLLoaderThrottle() override;
 
   // content::URLLoaderThrottle implementation.
+  void DetachFromCurrentSequence() override;
   void WillStartRequest(const content::ResourceRequest& request,
                         bool* defer) override;
   void WillRedirectRequest(const net::RedirectInfo& redirect_info,
@@ -39,6 +40,11 @@
   mojom::SafeBrowsing* safe_browsing_;
   const int render_frame_id_;
 
+  // These fields hold the connection to this instance's private connection to
+  // the Safe Browsing service if DetachFromCurrentThread has been called.
+  mojom::SafeBrowsingPtrInfo safe_browsing_ptr_info_;
+  mojom::SafeBrowsingPtr safe_browsing_ptr_;
+
   mojom::SafeBrowsingUrlCheckerPtr url_checker_;
 
   size_t pending_checks_ = 0;

diff --git a/components/safe_browsing/renderer/websocket_sb_handshake_throttle.cc b/components/safe_browsing/renderer/websocket_sb_handshake_throttle.cc
index 5eb84dcc1..7886335 100644
--- a/components/safe_browsing/renderer/websocket_sb_handshake_throttle.cc
+++ b/components/safe_browsing/renderer/websocket_sb_handshake_throttle.cc

@@ -15,6 +15,7 @@
 #include "content/public/renderer/render_frame.h"
 #include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
+#include "net/http/http_request_headers.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 
@@ -60,7 +61,8 @@
   start_time_ = base::TimeTicks::Now();
   safe_browsing_->CreateCheckerAndCheck(
       render_frame_id, mojo::MakeRequest(&url_checker_), url, "GET",
-      std::string(), load_flags, content::RESOURCE_TYPE_SUB_RESOURCE, false,
+      net::HttpRequestHeaders(), load_flags,
+      content::RESOURCE_TYPE_SUB_RESOURCE, false,
       base::BindOnce(&WebSocketSBHandshakeThrottle::OnCheckResult,
                      weak_factory_.GetWeakPtr()));
 

diff --git a/components/safe_browsing/renderer/websocket_sb_handshake_throttle_unittest.cc b/components/safe_browsing/renderer/websocket_sb_handshake_throttle_unittest.cc
index 6a760bb..b3eaa7d56 100644
--- a/components/safe_browsing/renderer/websocket_sb_handshake_throttle_unittest.cc
+++ b/components/safe_browsing/renderer/websocket_sb_handshake_throttle_unittest.cc

@@ -14,6 +14,7 @@
 #include "content/public/common/resource_type.h"
 #include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "net/http/http_request_headers.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/platform/WebString.h"
@@ -37,7 +38,7 @@
                              mojom::SafeBrowsingUrlCheckerRequest request,
                              const GURL& url,
                              const std::string& method,
-                             const std::string& headers,
+                             const net::HttpRequestHeaders& headers,
                              int32_t load_flags,
                              content::ResourceType resource_type,
                              bool has_user_gesture,
@@ -54,13 +55,15 @@
     run_loop_.Quit();
   }
 
+  void Clone(mojom::SafeBrowsingRequest request) override { NOTREACHED(); }
+
   void RunUntilCalled() { run_loop_.Run(); }
 
   int32_t render_frame_id_;
   mojom::SafeBrowsingUrlCheckerRequest request_;
   GURL url_;
   std::string method_;
-  std::string headers_;
+  net::HttpRequestHeaders headers_;
   int32_t load_flags_;
   content::ResourceType resource_type_;
   bool has_user_gesture_;
@@ -119,7 +122,7 @@
   EXPECT_EQ(MSG_ROUTING_NONE, safe_browsing_.render_frame_id_);
   EXPECT_EQ(GURL(kTestUrl), safe_browsing_.url_);
   EXPECT_EQ("GET", safe_browsing_.method_);
-  EXPECT_TRUE(safe_browsing_.headers_.empty());
+  EXPECT_TRUE(safe_browsing_.headers_.GetHeaderVector().empty());
   EXPECT_EQ(0, safe_browsing_.load_flags_);
   EXPECT_EQ(content::RESOURCE_TYPE_SUB_RESOURCE, safe_browsing_.resource_type_);
   EXPECT_FALSE(safe_browsing_.has_user_gesture_);

diff --git a/components/signin/core/browser/about_signin_internals.cc b/components/signin/core/browser/about_signin_internals.cc
index 757a42fc..aa6578f 100644
--- a/components/signin/core/browser/about_signin_internals.cc
+++ b/components/signin/core/browser/about_signin_internals.cc

@@ -270,6 +270,7 @@
   RefreshSigninPrefs();
 
   signin_error_controller_->AddObserver(this);
+  signin_manager_->AddObserver(this);
   signin_manager_->AddSigninDiagnosticsObserver(this);
   token_service_->AddDiagnosticsObserver(this);
   cookie_manager_service_->AddObserver(this);
@@ -277,6 +278,7 @@
 
 void AboutSigninInternals::Shutdown() {
   signin_error_controller_->RemoveObserver(this);
+  signin_manager_->RemoveObserver(this);
   signin_manager_->RemoveSigninDiagnosticsObserver(this);
   token_service_->RemoveDiagnosticsObserver(this);
   cookie_manager_service_->RemoveObserver(this);

diff --git a/components/signin/core/browser/signin_header_helper.cc b/components/signin/core/browser/signin_header_helper.cc
index d1a77f0..ef836c4 100644
--- a/components/signin/core/browser/signin_header_helper.cc
+++ b/components/signin/core/browser/signin_header_helper.cc

@@ -24,8 +24,9 @@
 
 namespace signin {
 
-extern const char kChromeConnectedHeader[] = "X-Chrome-Connected";
-extern const char kDiceRequestHeader[] = "X-Chrome-ID-Consistency-Request";
+const char kChromeConnectedHeader[] = "X-Chrome-Connected";
+const char kDiceRequestHeader[] = "X-Chrome-ID-Consistency-Request";
+const char kDiceResponseHeader[] = "X-Chrome-ID-Consistency-Response";
 
 ManageAccountsParams::ManageAccountsParams()
     : service_type(GAIA_SERVICE_TYPE_NONE),

diff --git a/components/signin/core/browser/signin_header_helper.h b/components/signin/core/browser/signin_header_helper.h
index 0e7b617..1e43ebb 100644
--- a/components/signin/core/browser/signin_header_helper.h
+++ b/components/signin/core/browser/signin_header_helper.h

@@ -33,6 +33,7 @@
 
 extern const char kChromeConnectedHeader[];
 extern const char kDiceRequestHeader[];
+extern const char kDiceResponseHeader[];
 
 // The ServiceType specified by Gaia in the response header accompanying the 204
 // response. This indicates the action Chrome is supposed to lead the user to

diff --git a/components/sync_bookmarks/bookmark_model_associator.cc b/components/sync_bookmarks/bookmark_model_associator.cc
index a490d4d..2281404 100644
--- a/components/sync_bookmarks/bookmark_model_associator.cc
+++ b/components/sync_bookmarks/bookmark_model_associator.cc

@@ -276,13 +276,7 @@
 void BookmarkModelAssociator::Context::UpdateDuplicateCount(
     const base::string16& title,
     const GURL& url) {
-  // base::Hash is defined for 8-byte strings only so have to
-  // cast the title data to char* and double the length in order to
-  // compute its hash.
-  size_t bookmark_hash = base::Hash(reinterpret_cast<const char*>(title.data()),
-                                    title.length() * 2) ^
-                         base::Hash(url.spec());
-
+  size_t bookmark_hash = base::Hash(title) ^ base::Hash(url.spec());
   if (!hashes_.insert(bookmark_hash).second) {
     // This hash code already exists in the set.
     ++duplicate_count_;

diff --git a/components/tracing/core/proto_zero_message_unittest.cc b/components/tracing/core/proto_zero_message_unittest.cc
index 90fecd6b..4b75b363 100644
--- a/components/tracing/core/proto_zero_message_unittest.cc
+++ b/components/tracing/core/proto_zero_message_unittest.cc

@@ -228,7 +228,7 @@
   // already covered in the other text fixtures. Keeping just a final smoke test
   // here on the full buffer hash.
   std::string full_buf = GetNextSerializedBytes(GetNumSerializedBytes());
-  uint32_t buf_hash = base::SuperFastHash(full_buf.data(), full_buf.size());
+  uint32_t buf_hash = base::PersistentHash(full_buf);
   EXPECT_EQ(0x14BC1BA3u, buf_hash);
 }
 

diff --git a/components/viz/common/quads/shared_bitmap.h b/components/viz/common/quads/shared_bitmap.h
index 0d5fa83..14683ce 100644
--- a/components/viz/common/quads/shared_bitmap.h
+++ b/components/viz/common/quads/shared_bitmap.h

@@ -24,7 +24,7 @@
 
 struct SharedBitmapIdHash {
   size_t operator()(const SharedBitmapId& id) const {
-    return base::Hash(reinterpret_cast<const char*>(id.name), sizeof(id.name));
+    return base::Hash(id.name, sizeof(id.name));
   }
 };
 

diff --git a/components/viz/host/server_gpu_memory_buffer_manager.cc b/components/viz/host/server_gpu_memory_buffer_manager.cc
index c90add6..dc4a48fc 100644
--- a/components/viz/host/server_gpu_memory_buffer_manager.cc
+++ b/components/viz/host/server_gpu_memory_buffer_manager.cc

@@ -213,9 +213,7 @@
   // TODO(sad|ssid): Find a better way once crbug.com/661257 is resolved.
   // The hash value is incremented so that the tracing id is never equal to
   // MemoryDumpManager::kInvalidTracingProcessId.
-  return static_cast<uint64_t>(base::Hash(
-             reinterpret_cast<const char*>(&client_id), sizeof(client_id))) +
-         1;
+  return static_cast<uint64_t>(base::Hash(&client_id, sizeof(client_id))) + 1;
 }
 
 void ServerGpuMemoryBufferManager::OnGpuMemoryBufferAllocated(

diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index d9c97df39..9776f7cf 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn

@@ -712,7 +712,6 @@
     "download/save_package_download_job.h",
     "download/save_types.cc",
     "download/save_types.h",
-    "download/url_download_handler.cc",
     "download/url_download_handler.h",
     "download/url_downloader.cc",
     "download/url_downloader.h",

diff --git a/content/browser/appcache/appcache_browsertest.cc b/content/browser/appcache/appcache_browsertest.cc
index b1dd1f3..86cdb98 100644
--- a/content/browser/appcache/appcache_browsertest.cc
+++ b/content/browser/appcache/appcache_browsertest.cc

@@ -3,8 +3,9 @@
 // found in the LICENSE file.
 
 #include <stdint.h>
-
+#include <set>
 #include "base/command_line.h"
+#include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "content/browser/appcache/appcache_subresource_url_factory.h"
@@ -32,14 +33,39 @@
   std::unique_ptr<net::test_server::HttpResponse> HandleRequest(
       const net::test_server::HttpRequest& request) {
     request_count_++;
+
+    relative_urls_seen_.insert(request.relative_url);
+
+    // Generate a redirect response for this resource.
+    if (!base::CompareCaseInsensitiveASCII(request.relative_url,
+                                           "/appcache/redirect/logo.png")) {
+      std::unique_ptr<net::test_server::BasicHttpResponse> http_response(
+          new net::test_server::BasicHttpResponse);
+      http_response->set_code(net::HTTP_TEMPORARY_REDIRECT);
+      std::string dest_url = request.base_url.spec();
+      dest_url += "appcache/logo.png";
+      http_response->AddCustomHeader("Location", dest_url.c_str());
+      redirect_count_++;
+      return std::move(http_response);
+    }
     return std::unique_ptr<net::test_server::HttpResponse>();
   }
 
   // Call this to reset the request_count_.
-  void Clear() { request_count_ = 0; }
+  void Clear() {
+    request_count_ = 0;
+    redirect_count_ = 0;
+    relative_urls_seen_.clear();
+  }
 
   int request_count() const { return request_count_; }
 
+  int redirect_count() const { return redirect_count_; }
+
+  bool SeenRelativeUrl(const std::string& url) {
+    return relative_urls_seen_.find(url) != relative_urls_seen_.end();
+  }
+
  protected:
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitchASCII(switches::kEnableFeatures,
@@ -49,6 +75,10 @@
  private:
   // Tracks the number of requests.
   int request_count_ = 0;
+  int redirect_count_ = 0;
+
+  // Holds the list of relative URLs seen by the HTTP request handler.
+  std::set<std::string> relative_urls_seen_;
 
   DISALLOW_COPY_AND_ASSIGN(AppCacheNetworkServiceBrowserTest);
 };
@@ -79,11 +109,11 @@
       embedded_test_server->GetURL("/appcache/simple_page_with_manifest.html");
 
   base::string16 expected_title = base::ASCIIToUTF16("AppCache updated");
-  TitleWatcher title_watcher(shell()->web_contents(), expected_title);
 
   // Load the main page twice. The second navigation should have AppCache
   // initialized for the page.
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  TitleWatcher title_watcher(shell()->web_contents(), expected_title);
   EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
 
   TestNavigationObserver observer(shell()->web_contents());
@@ -102,6 +132,54 @@
   EXPECT_EQ(page_no_manifest, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 }
+
+// This test validates that navigating to a page which has an AppCache manifest
+// and subresources which are redirected to resources which exist in the
+// AppCache are loaded from the cache.
+IN_PROC_BROWSER_TEST_F(AppCacheNetworkServiceBrowserTest,
+                       VerifyRedirectedSubresourceAppCacheLoad) {
+  std::unique_ptr<net::EmbeddedTestServer> embedded_test_server(
+      new net::EmbeddedTestServer());
+
+  embedded_test_server->RegisterRequestHandler(
+      base::Bind(&AppCacheNetworkServiceBrowserTest::HandleRequest,
+                 base::Unretained(this)));
+
+  base::FilePath content_test_data(FILE_PATH_LITERAL("content/test/data"));
+  embedded_test_server->AddDefaultHandlers(content_test_data);
+
+  ASSERT_TRUE(embedded_test_server->Start());
+
+  GURL main_url = embedded_test_server->GetURL(
+      "/appcache/simple_page_redirected_resource_manifest.html");
+
+  base::string16 expected_title = base::ASCIIToUTF16("AppCache updated");
+
+  // Load the main page twice. The second navigation should have AppCache
+  // initialized for the page.
+  // We expect to a redirect response and then a request for the redirected
+  // resource here.
+  TitleWatcher title_watcher_update(shell()->web_contents(), expected_title);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  EXPECT_EQ(expected_title, title_watcher_update.WaitAndGetTitle());
+  EXPECT_EQ(1, redirect_count());
+  EXPECT_TRUE(SeenRelativeUrl("/appcache/redirect/logo.png"));
+  EXPECT_TRUE(SeenRelativeUrl("/appcache/logo.png"));
+
+  // The second attempt to load the page should serve the resources out of the
+  // cache. Here we expect to see one redirect request. The redirected resource
+  // should be served out of the AppCache.
+  Clear();
+  expected_title = base::ASCIIToUTF16("AppCache image loaded");
+  TitleWatcher title_watcher_image_loaded(shell()->web_contents(),
+                                          expected_title);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  EXPECT_EQ(1, redirect_count());
+  EXPECT_TRUE(SeenRelativeUrl("/appcache/redirect/logo.png"));
+  EXPECT_FALSE(SeenRelativeUrl("/appcache/logo.png"));
+  EXPECT_EQ(expected_title, title_watcher_image_loaded.WaitAndGetTitle());
+}
+
 #endif
 
 }  // namespace content
\ No newline at end of file

diff --git a/content/browser/appcache/appcache_frontend_proxy.cc b/content/browser/appcache/appcache_frontend_proxy.cc
index 4242304a..9185216 100644
--- a/content/browser/appcache/appcache_frontend_proxy.cc
+++ b/content/browser/appcache/appcache_frontend_proxy.cc

@@ -53,4 +53,11 @@
   sender_->Send(new AppCacheMsg_ContentBlocked(host_id, manifest_url));
 }
 
+void AppCacheFrontendProxy::OnSetSubresourceFactory(
+    int host_id,
+    mojo::MessagePipeHandle loader_factory_pipe_handle) {
+  sender_->Send(new AppCacheMsg_SetSubresourceFactory(
+      host_id, loader_factory_pipe_handle));
+}
+
 }  // namespace content

diff --git a/content/browser/appcache/appcache_frontend_proxy.h b/content/browser/appcache/appcache_frontend_proxy.h
index 65d03ee..91b211e 100644
--- a/content/browser/appcache/appcache_frontend_proxy.h
+++ b/content/browser/appcache/appcache_frontend_proxy.h

@@ -34,6 +34,9 @@
                     AppCacheLogLevel log_level,
                     const std::string& message) override;
   void OnContentBlocked(int host_id, const GURL& manifest_url) override;
+  void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override;
 
  private:
   IPC::Sender* sender_;

diff --git a/content/browser/appcache/appcache_group_unittest.cc b/content/browser/appcache/appcache_group_unittest.cc
index fbc489dd..9aace667 100644
--- a/content/browser/appcache/appcache_group_unittest.cc
+++ b/content/browser/appcache/appcache_group_unittest.cc

@@ -52,6 +52,10 @@
 
   void OnContentBlocked(int host_id, const GURL& manifest_url) override {}
 
+  void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override {}
+
   int last_host_id_;
   int64_t last_cache_id_;
   content::AppCacheStatus last_status_;

diff --git a/content/browser/appcache/appcache_host.cc b/content/browser/appcache/appcache_host.cc
index 2d05e2df..58a10dc1 100644
--- a/content/browser/appcache/appcache_host.cc
+++ b/content/browser/appcache/appcache_host.cc

@@ -13,6 +13,9 @@
 #include "content/browser/appcache/appcache_policy.h"
 #include "content/browser/appcache/appcache_request.h"
 #include "content/browser/appcache/appcache_request_handler.h"
+#include "content/browser/appcache/appcache_subresource_url_factory.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/url_loader_factory.mojom.h"
 #include "net/url_request/url_request.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
 
@@ -495,6 +498,10 @@
     FillCacheInfo(
         associated_cache_.get(), preferred_manifest_url_, GetStatus(), &info);
     associated_cache_info_pending_ = false;
+    // In the network service world, we need to pass the URLLoaderFactory
+    // instance to the renderer which it can use to request subresources.
+    // This ensures that they can be served out of the AppCache.
+    MaybePassSubresourceFactory();
     frontend_->OnCacheSelected(host_id_, info);
   }
 }
@@ -551,6 +558,29 @@
   return weak_factory_.GetWeakPtr();
 }
 
+void AppCacheHost::MaybePassSubresourceFactory() {
+  if (!base::FeatureList::IsEnabled(features::kNetworkService))
+    return;
+
+  // We already have a valid factory. This happens when the document was loaded
+  // from the AppCache during navigation.
+  if (subresource_url_factory_.get())
+    return;
+
+  mojom::URLLoaderFactoryPtr factory_ptr = nullptr;
+
+  AppCacheSubresourceURLFactory::CreateURLLoaderFactory(
+      service()->url_loader_factory_getter(), GetWeakPtr(), &factory_ptr);
+
+  frontend_->OnSetSubresourceFactory(
+      host_id(), factory_ptr.PassInterface().PassHandle().release());
+}
+
+void AppCacheHost::SetAppCacheSubresourceFactory(
+    AppCacheSubresourceURLFactory* subresource_factory) {
+  subresource_url_factory_ = subresource_factory->GetWeakPtr();
+}
+
 void AppCacheHost::AssociateNoCache(const GURL& manifest_url) {
   // manifest url can be empty.
   AssociateCacheHelper(NULL, manifest_url);
@@ -582,6 +612,12 @@
     cache->AssociateHost(this);
 
   FillCacheInfo(cache, manifest_url, GetStatus(), &info);
+  // In the network service world, we need to pass the URLLoaderFactory
+  // instance to the renderer which it can use to request subresources.
+  // This ensures that they can be served out of the AppCache.
+  if (cache && cache->is_complete())
+    MaybePassSubresourceFactory();
+
   frontend_->OnCacheSelected(host_id_, info);
 }
 

diff --git a/content/browser/appcache/appcache_host.h b/content/browser/appcache/appcache_host.h
index afb06ccc..d49fc865 100644
--- a/content/browser/appcache/appcache_host.h
+++ b/content/browser/appcache/appcache_host.h

@@ -49,6 +49,7 @@
 class AppCacheRequestHandler;
 class AppCacheRequestHandlerTest;
 class AppCacheStorageImplTest;
+class AppCacheSubresourceURLFactory;
 class AppCacheTest;
 class AppCacheUpdateJobTest;
 
@@ -196,6 +197,16 @@
   // Returns a weak pointer reference to the host.
   base::WeakPtr<AppCacheHost> GetWeakPtr();
 
+  // In the network service world, we need to pass the URLLoaderFactory
+  // instance to the renderer which it can use to request subresources.
+  // This ensures that they can be served out of the AppCache.
+  void MaybePassSubresourceFactory();
+
+  // This is called when the frame is navigated to a page which loads from
+  // the AppCache.
+  void SetAppCacheSubresourceFactory(
+      AppCacheSubresourceURLFactory* subresource_factory);
+
  private:
   friend class content::AppCacheHostTest;
   friend class content::AppCacheStorageImplTest;
@@ -355,6 +366,9 @@
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheHostTest, SelectCacheTwice);
   FRIEND_TEST_ALL_PREFIXES(content::AppCacheTest, CleanupUnusedCache);
 
+  // In the network service world points to the subresource URLLoaderFactory.
+  base::WeakPtr<AppCacheSubresourceURLFactory> subresource_url_factory_;
+
   base::WeakPtrFactory<AppCacheHost> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(AppCacheHost);

diff --git a/content/browser/appcache/appcache_host_unittest.cc b/content/browser/appcache/appcache_host_unittest.cc
index b4e7d2d..46b40aa 100644
--- a/content/browser/appcache/appcache_host_unittest.cc
+++ b/content/browser/appcache/appcache_host_unittest.cc

@@ -75,6 +75,10 @@
       content_blocked_ = true;
     }
 
+    void OnSetSubresourceFactory(
+        int host_id,
+        mojo::MessagePipeHandle loader_factory_pipe_handle) override {}
+
     int last_host_id_;
     int64_t last_cache_id_;
     AppCacheStatus last_status_;

diff --git a/content/browser/appcache/appcache_navigation_handle_core.cc b/content/browser/appcache/appcache_navigation_handle_core.cc
index 83a6ccf..f194fbed 100644
--- a/content/browser/appcache/appcache_navigation_handle_core.cc
+++ b/content/browser/appcache/appcache_navigation_handle_core.cc

@@ -123,4 +123,11 @@
   DCHECK(false);
 }
 
+void AppCacheNavigationHandleCore::OnSetSubresourceFactory(
+    int host_id,
+    mojo::MessagePipeHandle loader_factory_pipe_handle) {
+  // Should never be called.
+  DCHECK(false);
+}
+
 }  // namespace content

diff --git a/content/browser/appcache/appcache_navigation_handle_core.h b/content/browser/appcache/appcache_navigation_handle_core.h
index fa9497a..7c7e45c8 100644
--- a/content/browser/appcache/appcache_navigation_handle_core.h
+++ b/content/browser/appcache/appcache_navigation_handle_core.h

@@ -65,6 +65,9 @@
                     AppCacheLogLevel log_level,
                     const std::string& message) override;
   void OnContentBlocked(int host_id, const GURL& manifest_url) override;
+  void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override;
 
  private:
   std::unique_ptr<AppCacheHost> precreated_host_;

diff --git a/content/browser/appcache/appcache_request_handler.cc b/content/browser/appcache/appcache_request_handler.cc
index 10148ba8..4af11d6 100644
--- a/content/browser/appcache/appcache_request_handler.cc
+++ b/content/browser/appcache/appcache_request_handler.cc

@@ -175,8 +175,16 @@
 
   // We don't fallback for responses that we delivered.
   if (job_.get()) {
-    DCHECK(!job_->IsDeliveringNetworkResponse());
-    return NULL;
+    // In the network service world the existing job initiates a fallback
+    // response request with the exception being a job which already
+    // delivered an AppCached or error response.
+    if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
+      DCHECK(!job_->IsDeliveringNetworkResponse());
+      return NULL;
+    } else if (job_->IsDeliveringAppCacheResponse() ||
+               job_->IsDeliveringErrorResponse()) {
+      return NULL;
+    }
   }
 
   if (request_->IsSuccess()) {
@@ -248,9 +256,11 @@
 
 AppCacheJob* AppCacheRequestHandler::MaybeCreateSubresourceLoader(
     std::unique_ptr<SubresourceLoadInfo> subresource_load_info,
-    URLLoaderFactoryGetter* loader_factory_getter) {
+    URLLoaderFactoryGetter* loader_factory_getter,
+    AppCacheSubresourceURLFactory* subresource_factory) {
   DCHECK(!is_main_resource());
   DCHECK(base::FeatureList::IsEnabled(features::kNetworkService));
+  job_ = nullptr;
 
   subresource_load_info_ = std::move(subresource_load_info);
   network_url_loader_factory_getter_ = loader_factory_getter;
@@ -261,8 +271,8 @@
 
   AppCacheURLLoaderJob* loader_job = job->AsURLLoaderJob();
   // The job takes ownership of the handler.
-  loader_job->set_request_handler(
-      std::unique_ptr<AppCacheRequestHandler>(this));
+  loader_job->SetRequestHandlerAndFactory(
+      std::unique_ptr<AppCacheRequestHandler>(this), subresource_factory);
   return job;
 }
 

diff --git a/content/browser/appcache/appcache_request_handler.h b/content/browser/appcache/appcache_request_handler.h
index 081c0bb..4f4570945 100644
--- a/content/browser/appcache/appcache_request_handler.h
+++ b/content/browser/appcache/appcache_request_handler.h

@@ -30,6 +30,7 @@
 namespace content {
 class AppCacheJob;
 class AppCacheNavigationHandleCore;
+class AppCacheSubresourceURLFactory;
 class AppCacheRequest;
 class AppCacheRequestHandlerTest;
 class AppCacheURLRequestJob;
@@ -78,9 +79,12 @@
   // The |loader_factory_getter| parameter points to the URLLoaderFactoryGetter
   // instance which provides functionality to return the default network
   // URLLoader interface.
+  // The |subresource_factory| parameter points to the AppCache URLLoader
+  // factory which serves subresources to the client.
   AppCacheJob* MaybeCreateSubresourceLoader(
       std::unique_ptr<SubresourceLoadInfo> subresource_load_info,
-      URLLoaderFactoryGetter* loader_factory_getter);
+      URLLoaderFactoryGetter* loader_factory_getter,
+      AppCacheSubresourceURLFactory* subresource_factory);
 
   static bool IsMainResourceType(ResourceType type) {
     return IsResourceTypeFrame(type) ||

diff --git a/content/browser/appcache/appcache_request_handler_unittest.cc b/content/browser/appcache/appcache_request_handler_unittest.cc
index dc81c0b1..b09cad2e 100644
--- a/content/browser/appcache/appcache_request_handler_unittest.cc
+++ b/content/browser/appcache/appcache_request_handler_unittest.cc

@@ -89,6 +89,10 @@
                       const std::string& message) override {}
 
     void OnContentBlocked(int host_id, const GURL& manifest_url) override {}
+
+    void OnSetSubresourceFactory(
+        int host_id,
+        mojo::MessagePipeHandle loader_factory_pipe_handle) override {}
   };
 
   // Helper callback to run a test on our io_thread. The io_thread is spun up

diff --git a/content/browser/appcache/appcache_storage_impl_unittest.cc b/content/browser/appcache/appcache_storage_impl_unittest.cc
index dd59d62..d852a11 100644
--- a/content/browser/appcache/appcache_storage_impl_unittest.cc
+++ b/content/browser/appcache/appcache_storage_impl_unittest.cc

@@ -1669,6 +1669,9 @@
                       AppCacheLogLevel log_level,
                       const std::string& message) override {}
     void OnContentBlocked(int host_id, const GURL& manifest_url) override {}
+    void OnSetSubresourceFactory(
+        int host_id,
+        mojo::MessagePipeHandle loader_factory_pipe_handle) override {}
 
     bool error_event_was_raised_;
   };

diff --git a/content/browser/appcache/appcache_subresource_url_factory.cc b/content/browser/appcache/appcache_subresource_url_factory.cc
index 65a0d5e1..0438c033 100644
--- a/content/browser/appcache/appcache_subresource_url_factory.cc
+++ b/content/browser/appcache/appcache_subresource_url_factory.cc

@@ -26,7 +26,8 @@
     URLLoaderFactoryGetter* default_url_loader_factory_getter,
     base::WeakPtr<AppCacheHost> host)
     : default_url_loader_factory_getter_(default_url_loader_factory_getter),
-      appcache_host_(host) {
+      appcache_host_(host),
+      weak_factory_(this) {
   bindings_.set_connection_error_handler(
       base::Bind(&AppCacheSubresourceURLFactory::OnConnectionError,
                  base::Unretained(this)));
@@ -39,6 +40,7 @@
     URLLoaderFactoryGetter* default_url_loader_factory_getter,
     base::WeakPtr<AppCacheHost> host,
     mojom::URLLoaderFactoryPtr* loader_factory) {
+  DCHECK(host.get());
   mojom::URLLoaderFactoryRequest request = mojo::MakeRequest(loader_factory);
 
   // This instance is effectively reference counted by the number of pipes open
@@ -47,6 +49,10 @@
   auto* impl = new AppCacheSubresourceURLFactory(
       default_url_loader_factory_getter, host);
   impl->Clone(std::move(request));
+
+  // Save the factory in the host to ensure that we don't create it again when
+  // the cache is selected, etc.
+  host->SetAppCacheSubresourceFactory(impl);
 }
 
 void AppCacheSubresourceURLFactory::CreateLoaderAndStart(
@@ -85,13 +91,10 @@
   load_info->client = std::move(client);
   load_info->traffic_annotation = traffic_annotation;
 
-  // TODO(ananta/michaeln)
-  // We need to handle redirects correctly, i.e every subresource redirect
-  // could potentially be served out of the cache.
   if (handler->MaybeCreateSubresourceLoader(
-          std::move(load_info), default_url_loader_factory_getter_.get())) {
-    // The handler is owned by the job and will be destoryed when the job is
-    // destroyed.
+          std::move(load_info), default_url_loader_factory_getter_.get(),
+          this)) {
+    // The handler is owned by the job and will be destroyed with the job.
     handler.release();
   }
 }
@@ -101,6 +104,35 @@
   bindings_.AddBinding(this, std::move(request));
 }
 
+base::WeakPtr<AppCacheSubresourceURLFactory>
+AppCacheSubresourceURLFactory::GetWeakPtr() {
+  return weak_factory_.GetWeakPtr();
+}
+
+void AppCacheSubresourceURLFactory::Restart(
+    const net::RedirectInfo& redirect_info,
+    std::unique_ptr<AppCacheRequestHandler> subresource_handler,
+    std::unique_ptr<SubresourceLoadInfo> subresource_load_info) {
+  if (!appcache_host_.get())
+    return;
+
+  // Should not hit the redirect limit.
+  DCHECK(subresource_load_info->redirect_limit > 0);
+
+  subresource_load_info->request.url = redirect_info.new_url;
+  subresource_load_info->request.method = redirect_info.new_method;
+  subresource_load_info->request.referrer = GURL(redirect_info.new_referrer);
+  subresource_load_info->request.site_for_cookies =
+      redirect_info.new_site_for_cookies;
+
+  if (subresource_handler->MaybeCreateSubresourceLoader(
+          std::move(subresource_load_info),
+          default_url_loader_factory_getter_.get(), this)) {
+    // The handler is owned by the job and will be destroyed with the job.
+    subresource_handler.release();
+  }
+}
+
 void AppCacheSubresourceURLFactory::OnConnectionError() {
   if (bindings_.empty())
     delete this;

diff --git a/content/browser/appcache/appcache_subresource_url_factory.h b/content/browser/appcache/appcache_subresource_url_factory.h
index 712cc375..9b6e504 100644
--- a/content/browser/appcache/appcache_subresource_url_factory.h
+++ b/content/browser/appcache/appcache_subresource_url_factory.h

@@ -17,8 +17,10 @@
 
 class AppCacheHost;
 class AppCacheJob;
+class AppCacheRequestHandler;
 class AppCacheServiceImpl;
 class URLLoaderFactoryGetter;
+struct SubresourceLoadInfo;
 
 // Implements the URLLoaderFactory mojom for AppCache subresource requests.
 class CONTENT_EXPORT AppCacheSubresourceURLFactory
@@ -48,6 +50,15 @@
                                 traffic_annotation) override;
   void Clone(mojom::URLLoaderFactoryRequest request) override;
 
+  base::WeakPtr<AppCacheSubresourceURLFactory> GetWeakPtr();
+
+  // Called bythe AppCacheURLLoaderJob to restart the request during a
+  // redirect. We attempt to serve the request out of the AppCache and if
+  // that fails we go to the network.
+  void Restart(const net::RedirectInfo& redirect_info,
+               std::unique_ptr<AppCacheRequestHandler> subresource_handler,
+               std::unique_ptr<SubresourceLoadInfo> subresource_load_info);
+
  private:
   friend class AppCacheNetworkServiceBrowserTest;
 
@@ -69,6 +80,8 @@
 
   base::WeakPtr<AppCacheHost> appcache_host_;
 
+  base::WeakPtrFactory<AppCacheSubresourceURLFactory> weak_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(AppCacheSubresourceURLFactory);
 };
 

diff --git a/content/browser/appcache/appcache_unittest.cc b/content/browser/appcache/appcache_unittest.cc
index 33496ca2..1806bca 100644
--- a/content/browser/appcache/appcache_unittest.cc
+++ b/content/browser/appcache/appcache_unittest.cc

@@ -32,6 +32,9 @@
                     AppCacheLogLevel log_level,
                     const std::string& message) override {}
   void OnContentBlocked(int host_id, const GURL& manifest_url) override {}
+  void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override {}
 };
 
 }  // namespace

diff --git a/content/browser/appcache/appcache_update_job.cc b/content/browser/appcache/appcache_update_job.cc
index 9405da9d..a88b6a0 100644
--- a/content/browser/appcache/appcache_update_job.cc
+++ b/content/browser/appcache/appcache_update_job.cc

@@ -78,7 +78,7 @@
 
   // Caller is responsible for ensuring there will be no duplicate hosts.
   void AddHost(AppCacheHost* host) {
-    std::pair<NotifyHostMap::iterator , bool> ret = hosts_to_notify.insert(
+    std::pair<NotifyHostMap::iterator, bool> ret = hosts_to_notify.insert(
         NotifyHostMap::value_type(host->frontend(), HostIds()));
     ret.first->second.push_back(host->host_id());
   }
@@ -98,13 +98,13 @@
     }
   }
 
-  void SendProgressNotifications(
-      const GURL& url, int num_total, int num_complete) {
+  void SendProgressNotifications(const GURL& url,
+                                 int num_total,
+                                 int num_complete) {
     for (NotifyHostMap::iterator it = hosts_to_notify.begin();
          it != hosts_to_notify.end(); ++it) {
       AppCacheFrontend* frontend = it->first;
-      frontend->OnProgressEventRaised(it->second, url,
-                                      num_total, num_complete);
+      frontend->OnProgressEventRaised(it->second, url, num_total, num_complete);
     }
   }
 
@@ -121,8 +121,8 @@
     for (NotifyHostMap::iterator it = hosts_to_notify.begin();
          it != hosts_to_notify.end(); ++it) {
       AppCacheFrontend* frontend = it->first;
-      for (HostIds::iterator id = it->second.begin();
-           id != it->second.end(); ++id) {
+      for (HostIds::iterator id = it->second.begin(); id != it->second.end();
+           ++id) {
         frontend->OnLogMessage(*id, APPCACHE_LOG_WARNING, message);
       }
     }
@@ -131,7 +131,6 @@
  private:
   NotifyHostMap hosts_to_notify;
 };
-
 AppCacheUpdateJob::UrlToFetch::UrlToFetch(const GURL& url,
                                           bool checked,
                                           AppCacheResponseInfo* info)
@@ -1300,6 +1299,7 @@
         if (times_changed)
           storage_->StoreEvictionTimes(group_);
       }
+      group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
       // 6.9.4 steps 7.3-7.7.
       NotifyAllAssociatedHosts(APPCACHE_NO_UPDATE_EVENT);
       DiscardDuplicateResponses();
@@ -1312,6 +1312,7 @@
     case REFETCH_MANIFEST:
       DCHECK(stored_state_ == STORED);
       NotifyAllFinalProgress();
+      group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
       if (update_type_ == CACHE_ATTEMPT)
         NotifyAllAssociatedHosts(APPCACHE_CACHED_EVENT);
       else

diff --git a/content/browser/appcache/appcache_update_job_unittest.cc b/content/browser/appcache/appcache_update_job_unittest.cc
index d91219f3..34a5466 100644
--- a/content/browser/appcache/appcache_update_job_unittest.cc
+++ b/content/browser/appcache/appcache_update_job_unittest.cc

@@ -314,6 +314,10 @@
 
   void OnContentBlocked(int host_id, const GURL& manifest_url) override {}
 
+  void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override {}
+
   void AddExpectedEvent(const std::vector<int>& host_ids,
       AppCacheEventID event_id) {
     DCHECK(!ignore_progress_events_ || event_id != APPCACHE_PROGRESS_EVENT);
@@ -608,9 +612,7 @@
       return;
     }
 
-    net::HttpRequestHeaders request_headers;
-    request_headers.AddHeadersFromString(url_request.headers);
-    HttpHeadersRequestTestJob::ValidateExtraHeaders(request_headers);
+    HttpHeadersRequestTestJob::ValidateExtraHeaders(url_request.headers);
 
     std::string headers;
     std::string body;

diff --git a/content/browser/appcache/appcache_update_url_loader_request.cc b/content/browser/appcache/appcache_update_url_loader_request.cc
index c6171c38..ae46c3c 100644
--- a/content/browser/appcache/appcache_update_url_loader_request.cc
+++ b/content/browser/appcache/appcache_update_url_loader_request.cc

@@ -30,7 +30,7 @@
 
 void AppCacheUpdateJob::UpdateURLLoaderRequest::SetExtraRequestHeaders(
     const net::HttpRequestHeaders& headers) {
-  request_.headers = headers.ToString();
+  request_.headers = headers;
 }
 
 GURL AppCacheUpdateJob::UpdateURLLoaderRequest::GetURL() const {

diff --git a/content/browser/appcache/appcache_url_loader_job.cc b/content/browser/appcache/appcache_url_loader_job.cc
index 74591da9..e240389 100644
--- a/content/browser/appcache/appcache_url_loader_job.cc
+++ b/content/browser/appcache/appcache_url_loader_job.cc

@@ -16,8 +16,20 @@
 
 namespace content {
 
+namespace {
+
+// Max number of http redirects to follow.  Same number as gecko.
+// TODO(ananta/michaeln). Avoid duplicating logic from the n/w stack and figure
+// out a way to use FollowRedirect() mechanism in the network URL loader.
+const int kMaxRedirects = 20;
+
+}  // namespace
+
 SubresourceLoadInfo::SubresourceLoadInfo()
-    : routing_id(-1), request_id(-1), options(0) {}
+    : routing_id(-1),
+      request_id(-1),
+      options(0),
+      redirect_limit(kMaxRedirects) {}
 
 SubresourceLoadInfo::~SubresourceLoadInfo() {}
 
@@ -59,9 +71,7 @@
   is_fallback_ = is_fallback;
 
   // Handle range requests.
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(request_.headers);
-  InitializeRangeRequestInfo(headers);
+  InitializeRangeRequestInfo(request_.headers);
 
   // TODO(ananta)
   // Implement the AppCacheServiceImpl::Observer interface or add weak pointer
@@ -134,6 +144,32 @@
 }
 
 void AppCacheURLLoaderJob::FollowRedirect() {
+  if (subresource_factory_.get()) {
+    if (storage_->usage_map()->find(
+            last_subresource_redirect_info_.new_url.GetOrigin()) !=
+        storage_->usage_map()->end()) {
+      // If we hit the redirect limit then attempt to load a fallback here.
+      // If that succeeds we are good. If not notify the client about the
+      // failure.
+      // TODO(ananta/michaeln)
+      // Avoid this logic and figure out a way to reuse the network loader's
+      // FollowRedirect mechanism.
+      subresource_load_info_->redirect_limit--;
+
+      if (subresource_load_info_->redirect_limit <= 0) {
+        HandleRedirectLimitHit();
+        return;
+      }
+      subresource_load_info_->client = std::move(client_);
+      subresource_load_info_->url_loader_request = binding_.Unbind();
+      subresource_factory_->Restart(last_subresource_redirect_info_,
+                                    std::move(sub_resource_handler_),
+                                    std::move(subresource_load_info_));
+      base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
+      return;
+    }
+  }
+
   if (network_loader_)
     network_loader_->FollowRedirect();
 }
@@ -170,18 +206,21 @@
     const net::RedirectInfo& redirect_info,
     const ResourceResponseHead& response_head) {
   appcache_request_->set_response(response_head);
+
   // The MaybeLoadFallbackForRedirect() call below can pass a fallback
   // response to us. Reset the delivery_type_ to ensure that we can
   // receive it
   delivery_type_ = AWAITING_DELIVERY_ORDERS;
-  if (!sub_resource_handler_->MaybeLoadFallbackForRedirect(
+  if (sub_resource_handler_->MaybeLoadFallbackForRedirect(
           nullptr, redirect_info.new_url)) {
-    client_->OnReceiveRedirect(redirect_info, response_head);
-  } else {
     // Disconnect from the network loader as we are delivering a fallback
     // response to the client.
     DisconnectFromNetworkLoader();
+    return;
   }
+
+  last_subresource_redirect_info_ = redirect_info;
+  client_->OnReceiveRedirect(redirect_info, response_head);
 }
 
 void AppCacheURLLoaderJob::OnDataDownloaded(int64_t data_len,
@@ -225,6 +264,13 @@
   client_->OnComplete(status);
 }
 
+void AppCacheURLLoaderJob::SetRequestHandlerAndFactory(
+    std::unique_ptr<AppCacheRequestHandler> handler,
+    AppCacheSubresourceURLFactory* subresource_factory) {
+  sub_resource_handler_ = std::move(handler);
+  subresource_factory_ = subresource_factory->GetWeakPtr();
+}
+
 void AppCacheURLLoaderJob::BindRequest(mojom::URLLoaderClientPtr client,
                                        mojom::URLLoaderRequest request) {
   DCHECK(!binding_.is_bound());
@@ -264,6 +310,7 @@
   if (subresource_load_info.get()) {
     DCHECK(loader_factory_getter);
     subresource_load_info_ = std::move(subresource_load_info);
+    request_ = subresource_load_info_->request;
 
     binding_.Bind(std::move(subresource_load_info_->url_loader_request));
     binding_.set_connection_error_handler(base::BindOnce(
@@ -431,8 +478,11 @@
   auto buffer =
       base::MakeRefCounted<network::NetToMojoIOBuffer>(pending_write_.get());
 
+  uint32_t bytes_to_read =
+      std::min<uint32_t>(num_bytes, info_->response_data_size());
+
   reader_->ReadData(
-      buffer.get(), info_->response_data_size(),
+      buffer.get(), bytes_to_read,
       base::Bind(&AppCacheURLLoaderJob::OnReadComplete, StaticAsWeakPtr(this)));
 }
 
@@ -482,4 +532,19 @@
   network_loader_ = nullptr;
 }
 
+void AppCacheURLLoaderJob::HandleRedirectLimitHit() {
+  DCHECK(sub_resource_handler_.get());
+  // TODO(ananta/michaeln)
+  // Fix the IsSuccess() function in the AppCacheURLLoaderRequest class.
+  // Currently presence of headers in the response is treated as success.
+  appcache_request_->set_response(ResourceResponseHead());
+  if (sub_resource_handler_->MaybeLoadFallbackForResponse(nullptr)) {
+    DisconnectFromNetworkLoader();
+  } else {
+    ResourceRequestCompletionStatus result;
+    result.error_code = net::ERR_FAILED;
+    client_->OnComplete(result);
+  }
+}
+
 }  // namespace content

diff --git a/content/browser/appcache/appcache_url_loader_job.h b/content/browser/appcache/appcache_url_loader_job.h
index 36c67fb..508c548 100644
--- a/content/browser/appcache/appcache_url_loader_job.h
+++ b/content/browser/appcache/appcache_url_loader_job.h

@@ -28,6 +28,7 @@
 
 namespace content {
 
+class AppCacheSubresourceURLFactory;
 class AppCacheRequest;
 class AppCacheURLLoaderRequest;
 class URLLoaderFactoryGetter;
@@ -45,6 +46,10 @@
   ResourceRequest request;
   mojom::URLLoaderClientPtr client;
   net::MutableNetworkTrafficAnnotationTag traffic_annotation;
+  // TODO(ananta/michaeln)
+  // Avoid duplicating the redirect limit logic in the n/w stack and figure
+  // out a way to use the FollowRedirect() mechanism in the network loader.
+  int redirect_limit;
 };
 
 // AppCacheJob wrapper for a mojom::URLLoader implementation which returns
@@ -100,10 +105,11 @@
   }
 
   // Ownership of the |handler| is transferred to us via this call. This is
-  // only for subresource requests.
-  void set_request_handler(std::unique_ptr<AppCacheRequestHandler> handler) {
-    sub_resource_handler_ = std::move(handler);
-  }
+  // only for subresource requests. The subresource_factory is maintained as
+  // a weak pointer.
+  void SetRequestHandlerAndFactory(
+      std::unique_ptr<AppCacheRequestHandler> handler,
+      AppCacheSubresourceURLFactory* subresource_factory);
 
   // Binds to the URLLoaderRequest instance passed in the |request| parameter.
   // The URLLoaderClient instance is passed in the |client| parameter. This
@@ -148,6 +154,10 @@
   // resources.
   void DisconnectFromNetworkLoader();
 
+  // If we hit the redirect limit for a subresource then we need to try a
+  // fallback or return a failure to the client. This function does that.
+  void HandleRedirectLimitHit();
+
   // The current request.
   ResourceRequest request_;
 
@@ -214,6 +224,12 @@
   // Please see OnReceiveResponse()
   bool received_response_;
 
+  // The last redirect seen for a subresource.
+  net::RedirectInfo last_subresource_redirect_info_;
+
+  // Used to restart the subresource request in case of a redirect.
+  base::WeakPtr<AppCacheSubresourceURLFactory> subresource_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(AppCacheURLLoaderJob);
 };
 

diff --git a/content/browser/blob_storage/blob_dispatcher_host_unittest.cc b/content/browser/blob_storage/blob_dispatcher_host_unittest.cc
index 631e7c36..68560c57 100644
--- a/content/browser/blob_storage/blob_dispatcher_host_unittest.cc
+++ b/content/browser/blob_storage/blob_dispatcher_host_unittest.cc

@@ -133,7 +133,8 @@
     ExpectBlobNotExist(id);
     DataElement element;
     element.SetToBytes(kData, kDataSize);
-    std::vector<DataElement> elements = {element};
+    std::vector<DataElement> elements;
+    elements.push_back(std::move(element));
     host_->OnRegisterBlob(id, std::string(kContentType),
                           std::string(kContentDisposition), elements);
     EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -146,7 +147,8 @@
     ExpectBlobNotExist(id);
     DataElement element;
     element.SetToBytesDescription(kDataSize);
-    std::vector<DataElement> elements = {element};
+    std::vector<DataElement> elements;
+    elements.push_back(std::move(element));
     host_->OnRegisterBlob(id, std::string(kContentType),
                           std::string(kContentDisposition), elements);
     EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -288,7 +290,8 @@
 
   DataElement expected;
   expected.SetToBytes(kData, kDataSize);
-  std::vector<DataElement> elements = {expected};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(expected));
   ExpectHandleEqualsData(handle.get(), elements);
 }
 
@@ -301,7 +304,8 @@
 
   DataElement expected;
   expected.SetToBytes(kData, kDataSize);
-  std::vector<DataElement> elements = {expected};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(expected));
   ExpectHandleEqualsData(handle.get(), elements);
 }
 
@@ -315,7 +319,8 @@
     ExpectBlobNotExist(id);
     DataElement element;
     element.SetToBytesDescription(kDataSize);
-    std::vector<DataElement> elements = {element};
+    std::vector<DataElement> elements;
+    elements.push_back(std::move(element));
     host_->OnRegisterBlob(id, std::string(kContentType),
                           std::string(kContentDisposition), elements);
     EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -346,7 +351,8 @@
   ExpectBlobNotExist(kId);
   DataElement element;
   element.SetToBytesDescription(kLargeSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -425,9 +431,11 @@
   DataElement expected;
   expected.SetToAllocatedBytes(kLargeSize / 2);
   std::memset(expected.mutable_bytes(), 'X', kLargeSize / 2);
-  elements = {expected};
+  elements.clear();
+  elements.push_back(std::move(expected));
+  expected.SetToAllocatedBytes(kLargeSize / 2);
   std::memset(expected.mutable_bytes(), 'Z', kLargeSize / 2);
-  elements.push_back(expected);
+  elements.push_back(std::move(expected));
   ExpectHandleEqualsData(handle.get(), elements);
 }
 
@@ -442,7 +450,8 @@
   // Start building blob.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   // It should have requested memory here.
@@ -475,7 +484,8 @@
   EXPECT_TRUE(handle);
   DataElement expected;
   expected.SetToBytes(kData, kDataSize);
-  std::vector<DataElement> expecteds = {expected};
+  std::vector<DataElement> expecteds;
+  expecteds.push_back(std::move(expected));
   ExpectHandleEqualsData(handle.get(), expecteds);
 
   // Verify we can't cancel after the fact.
@@ -513,7 +523,8 @@
   // Start building blob.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
 
@@ -547,7 +558,8 @@
   // Start building blob.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
 
@@ -591,7 +603,8 @@
   // Decrement the refcount while building, after we call OnStartBuildlingBlob.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -647,7 +660,8 @@
   // OnStartBuildlingBlob, except we have another handle.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -697,7 +711,8 @@
   // Host deleted after OnStartBuilding.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
 
@@ -717,7 +732,10 @@
   // Host deleted after OnMemoryItemResponse.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element, element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
+  element.SetToBytesDescription(kDataSize);
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
 
@@ -748,7 +766,8 @@
   const std::string kCircularId("id1");
   DataElement element;
   element.SetToBlob(kCircularId);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kCircularId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   ExpectAndResetBadMessage();
@@ -758,7 +777,8 @@
 
   // Next, test a blob that references a broken blob.
   element.SetToBytesDescription(kDataSize);
-  elements = {element};
+  elements.clear();
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kBrokenId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   EXPECT_FALSE(host_->shutdown_for_bad_message_);
@@ -771,9 +791,11 @@
   // Create referencing blob. We should be broken right away, but also ignore
   // the subsequent OnStart message.
   element.SetToBytesDescription(kDataSize);
-  elements = {element};
+  elements.clear();
+  elements.push_back(std::move(element));
+  element.SetToBytesDescription(kDataSize);
   element.SetToBlob(kBrokenId);
-  elements.push_back(element);
+  elements.push_back(std::move(element));
   host_->OnRegisterBlob(kReferencingId, std::string(kContentType),
                         std::string(kContentDisposition), elements);
   EXPECT_TRUE(context_->GetBlobDataFromUUID(kReferencingId)->IsBroken());
@@ -788,7 +810,8 @@
   // Data elements for our transfer & checking messages.
   DataElement element;
   element.SetToBytesDescription(kDataSize);
-  std::vector<DataElement> elements = {element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
   std::vector<BlobItemBytesRequest> expected_requests = {
       BlobItemBytesRequest::CreateIPCRequest(0, 0, 0, kDataSize)};
   BlobItemBytesResponse response(0);
@@ -855,8 +878,10 @@
   element.SetToBytesDescription(kDataSize);
   DataElement referencing_element;
   referencing_element.SetToBlob(kId);
-  std::vector<DataElement> elements = {element};
-  std::vector<DataElement> referencing_elements = {referencing_element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
+  std::vector<DataElement> referencing_elements;
+  referencing_elements.push_back(std::move(referencing_element));
   std::vector<BlobItemBytesRequest> expected_requests = {
       BlobItemBytesRequest::CreateIPCRequest(0, 0, 0, kDataSize)};
   BlobItemBytesResponse response(0);
@@ -921,7 +946,8 @@
       context_->GetBlobDataFromUUID(kDifferentHostReferencingId);
   DataElement expected;
   expected.SetToBytes(kData, kDataSize);
-  std::vector<DataElement> expecteds = {expected};
+  std::vector<DataElement> expecteds;
+  expecteds.push_back(std::move(expected));
   ExpectHandleEqualsData(handle.get(), expecteds);
 }
 
@@ -934,8 +960,10 @@
   element.SetToBytesDescription(kDataSize);
   DataElement referencing_element;
   referencing_element.SetToBlob(kId);
-  std::vector<DataElement> elements = {element};
-  std::vector<DataElement> referencing_elements = {referencing_element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
+  std::vector<DataElement> referencing_elements;
+  referencing_elements.push_back(std::move(referencing_element));
   std::vector<BlobItemBytesRequest> expected_requests = {
       BlobItemBytesRequest::CreateIPCRequest(0, 0, 0, kDataSize)};
 
@@ -1009,8 +1037,10 @@
   element.SetToBytesDescription(kDataSize);
   DataElement referencing_element;
   referencing_element.SetToBlob(kId);
-  std::vector<DataElement> elements = {element};
-  std::vector<DataElement> referencing_elements = {referencing_element};
+  std::vector<DataElement> elements;
+  elements.push_back(std::move(element));
+  std::vector<DataElement> referencing_elements;
+  referencing_elements.push_back(std::move(referencing_element));
   std::vector<BlobItemBytesRequest> expected_requests = {
       BlobItemBytesRequest::CreateIPCRequest(0, 0, 0, kDataSize)};
   BlobItemBytesResponse response(0);

diff --git a/content/browser/blob_storage/blob_transport_host_unittest.cc b/content/browser/blob_storage/blob_transport_host_unittest.cc
index 481e2f0a..41c31fe 100644
--- a/content/browser/blob_storage/blob_transport_host_unittest.cc
+++ b/content/browser/blob_storage/blob_transport_host_unittest.cc

@@ -43,14 +43,14 @@
 void AddMemoryItem(size_t length, std::vector<DataElement>* out) {
   DataElement bytes;
   bytes.SetToBytesDescription(length);
-  out->push_back(bytes);
+  out->push_back(std::move(bytes));
 }
 
 void AddShortcutMemoryItem(size_t length, std::vector<DataElement>* out) {
   DataElement bytes;
   bytes.SetToAllocatedBytes(length);
   PopulateBytes(bytes.mutable_bytes(), length);
-  out->push_back(bytes);
+  out->push_back(std::move(bytes));
 }
 
 void AddShortcutMemoryItem(size_t length, BlobDataBuilder* out) {
@@ -63,7 +63,7 @@
 void AddBlobItem(std::vector<DataElement>* out) {
   DataElement blob;
   blob.SetToBlob(kCompletedBlobUUID);
-  out->push_back(blob);
+  out->push_back(std::move(blob));
 }
 }  // namespace
 
@@ -460,9 +460,9 @@
   // Finish the third one, with a reference to the first and second blob.
   DataElement element;
   element.SetToBlob(kBlob1);
-  descriptions.push_back(element);
+  descriptions.push_back(std::move(element));
   element.SetToBlob(kBlob2);
-  descriptions.push_back(element);
+  descriptions.push_back(std::move(element));
 
   EXPECT_EQ(BlobStatus::PENDING_TRANSPORT,
             BuildBlobAsync(kBlob3, descriptions, &handle3));

diff --git a/content/browser/blob_storage/blob_url_loader_factory.cc b/content/browser/blob_storage/blob_url_loader_factory.cc
index e4d16554..a783374b 100644
--- a/content/browser/blob_storage/blob_url_loader_factory.cc
+++ b/content/browser/blob_storage/blob_url_loader_factory.cc

@@ -76,10 +76,8 @@
       return;
     }
 
-    net::HttpRequestHeaders request_headers;
-    request_headers.AddHeadersFromString(request.headers);
     std::string range_header;
-    if (request_headers.GetHeader(net::HttpRequestHeaders::kRange,
+    if (request.headers.GetHeader(net::HttpRequestHeaders::kRange,
                                   &range_header)) {
       // We only care about "Range" header here.
       std::vector<net::HttpByteRange> ranges;

diff --git a/content/browser/blob_storage/blob_url_unittest.cc b/content/browser/blob_storage/blob_url_unittest.cc
index da49844..dbfa815 100644
--- a/content/browser/blob_storage/blob_url_unittest.cc
+++ b/content/browser/blob_storage/blob_url_unittest.cc

@@ -277,8 +277,7 @@
       ResourceRequest request;
       request.url = url;
       request.method = method;
-      if (!extra_headers.IsEmpty())
-        request.headers = extra_headers.ToString();
+      request.headers = extra_headers;
 
       mojom::URLLoaderPtr url_loader;
       TestURLLoaderClient url_loader_client;

diff --git a/content/browser/bluetooth/bluetooth_metrics.cc b/content/browser/bluetooth/bluetooth_metrics.cc
index 0af1577..97b53f00 100644
--- a/content/browser/bluetooth/bluetooth_metrics.cc
+++ b/content/browser/bluetooth/bluetooth_metrics.cc

@@ -31,8 +31,7 @@
 
   // TODO(520284): Other than verifying that |uuid| contains a value, this logic
   // should be migrated to a dedicated histogram macro for hashed strings.
-  uint32_t data =
-      base::SuperFastHash(canonical_uuid.data(), canonical_uuid.size());
+  uint32_t data = base::PersistentHash(canonical_uuid);
 
   // Strip off the sign bit because UMA doesn't support negative values,
   // but takes a signed int as input.

diff --git a/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc b/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc
index 35f96f2..530bb049 100644
--- a/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc
+++ b/content/browser/bluetooth/tools/bluetooth_metrics_hash.cc

@@ -34,8 +34,7 @@
     std::string label_string((i + 1 < argc) ? argv[i + 1] : "");
     device::BluetoothUUID uuid(uuid_string);
     std::string uuid_canonical_string = uuid.canonical_value();
-    uint32_t hash = base::SuperFastHash(uuid_canonical_string.data(),
-                                        uuid_canonical_string.size());
+    uint32_t hash = base::PersistentHash(uuid_canonical_string);
 
     // Strip off the sign bit because UMA doesn't support negative values,
     // but takes a signed int as input.

diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index 13e452c..7b7c476 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc

@@ -712,8 +712,10 @@
   // associated BrowserPlugin know. We only need to send this if we're attached,
   // as guest_crashed_ is cleared automatically on attach anyways.
   if (attached()) {
+    RenderWidgetHostViewGuest* rwhv = static_cast<RenderWidgetHostViewGuest*>(
+        web_contents()->GetRenderWidgetHostView());
     SendMessageToEmbedder(base::MakeUnique<BrowserPluginMsg_GuestReady>(
-        browser_plugin_instance_id()));
+        browser_plugin_instance_id(), rwhv->GetFrameSinkId()));
   }
 
   RenderWidgetHostImpl::From(rvh->GetWidget())
@@ -1066,12 +1068,21 @@
   mouse_locked_ = false;
 }
 
-void BrowserPluginGuest::OnUpdateGeometry(int browser_plugin_instance_id,
-                                          const gfx::Rect& view_rect) {
+void BrowserPluginGuest::OnUpdateGeometry(
+    int browser_plugin_instance_id,
+    const gfx::Rect& view_rect,
+    const viz::LocalSurfaceId& local_surface_id) {
   // The plugin has moved within the embedder without resizing or the
   // embedder/container's view rect changing.
   guest_window_rect_ = view_rect;
   GetWebContents()->SendScreenRects();
+  if (local_surface_id_ != local_surface_id) {
+    local_surface_id_ = local_surface_id;
+    web_contents()
+        ->GetRenderWidgetHostView()
+        ->GetRenderWidgetHost()
+        ->WasResized();
+  }
 }
 
 void BrowserPluginGuest::OnHasTouchEventHandlers(bool accept) {

diff --git a/content/browser/browser_plugin/browser_plugin_guest.h b/content/browser/browser_plugin/browser_plugin_guest.h
index ac97e22..17540f9d 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/content/browser/browser_plugin/browser_plugin_guest.h

@@ -29,6 +29,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/values.h"
 #include "build/build_config.h"
+#include "components/viz/common/surfaces/local_surface_id.h"
 #include "content/common/edit_command.h"
 #include "content/common/input/input_event_ack_state.h"
 #include "content/public/browser/browser_plugin_guest_delegate.h"
@@ -56,6 +57,7 @@
 }  // namespace gfx
 
 namespace viz {
+class LocalSurfaceId;
 class SurfaceId;
 class SurfaceInfo;
 struct SurfaceSequence;
@@ -161,6 +163,13 @@
 
   bool focused() const { return focused_; }
   bool visible() const { return guest_visible_; }
+
+  // Returns the viz::LocalSurfaceId propagated from the parent to be used by
+  // this guest.
+  const viz::LocalSurfaceId& local_surface_id() const {
+    return local_surface_id_;
+  }
+
   bool is_in_destruction() { return is_in_destruction_; }
 
   void UpdateVisibility();
@@ -330,7 +339,9 @@
   void OnSetVisibility(int instance_id, bool visible);
   void OnUnlockMouse();
   void OnUnlockMouseAck(int instance_id);
-  void OnUpdateGeometry(int instance_id, const gfx::Rect& view_rect);
+  void OnUpdateGeometry(int instance_id,
+                        const gfx::Rect& view_rect,
+                        const viz::LocalSurfaceId& local_surface_id);
 
   void OnTextInputStateChanged(const TextInputState& params);
   void OnImeSetComposition(
@@ -451,6 +462,8 @@
   // WebContents associated with this BrowserPluginGuest has OOPIF structure.
   bool can_use_cross_process_frames_;
 
+  viz::LocalSurfaceId local_surface_id_;
+
   // Weak pointer used to ask GeolocationPermissionContext about geolocation
   // permission.
   base::WeakPtrFactory<BrowserPluginGuest> weak_ptr_factory_;

diff --git a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
index 7b463197..f33f088 100644
--- a/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
+++ b/content/browser/devtools/protocol/devtools_protocol_browsertest.cc

@@ -2136,7 +2136,7 @@
  public:
   CountingDownloadFile(std::unique_ptr<DownloadSaveInfo> save_info,
                        const base::FilePath& default_downloads_directory,
-                       std::unique_ptr<ByteStreamReader> stream,
+                       std::unique_ptr<DownloadManager::InputStream> stream,
                        const net::NetLogWithSource& net_log,
                        base::WeakPtr<DownloadDestinationObserver> observer)
       : DownloadFileImpl(std::move(save_info),
@@ -2193,7 +2193,7 @@
   DownloadFile* CreateFile(
       std::unique_ptr<DownloadSaveInfo> save_info,
       const base::FilePath& default_downloads_directory,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const net::NetLogWithSource& net_log,
       base::WeakPtr<DownloadDestinationObserver> observer) override {
     return new CountingDownloadFile(std::move(save_info),

diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/browser/devtools/protocol/network_handler.cc
index 8b406dc..a7970f9f 100644
--- a/content/browser/devtools/protocol/network_handler.cc
+++ b/content/browser/devtools/protocol/network_handler.cc

@@ -788,9 +788,7 @@
     return;
   const std::string version_id(base::IntToString(worker_version_id));
   std::unique_ptr<DictionaryValue> headers_dict(DictionaryValue::create());
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(request.headers);
-  for (net::HttpRequestHeaders::Iterator it(headers); it.GetNext();)
+  for (net::HttpRequestHeaders::Iterator it(request.headers); it.GetNext();)
     headers_dict->setString(it.name(), it.value());
   frontend_->RequestWillBeSent(
       request_id, "" /* loader_id */, request.url.spec(),

diff --git a/content/browser/download/download_browsertest.cc b/content/browser/download/download_browsertest.cc
index 0879a3f..f2395e39 100644
--- a/content/browser/download/download_browsertest.cc
+++ b/content/browser/download/download_browsertest.cc

@@ -145,13 +145,12 @@
 
 class DownloadFileWithDelay : public DownloadFileImpl {
  public:
-  DownloadFileWithDelay(
-      std::unique_ptr<DownloadSaveInfo> save_info,
-      const base::FilePath& default_download_directory,
-      std::unique_ptr<ByteStreamReader> stream,
-      const net::NetLogWithSource& net_log,
-      base::WeakPtr<DownloadDestinationObserver> observer,
-      base::WeakPtr<DownloadFileWithDelayFactory> owner);
+  DownloadFileWithDelay(std::unique_ptr<DownloadSaveInfo> save_info,
+                        const base::FilePath& default_download_directory,
+                        std::unique_ptr<DownloadManager::InputStream> stream,
+                        const net::NetLogWithSource& net_log,
+                        base::WeakPtr<DownloadDestinationObserver> observer,
+                        base::WeakPtr<DownloadFileWithDelayFactory> owner);
 
   ~DownloadFileWithDelay() override;
 
@@ -193,7 +192,7 @@
   DownloadFile* CreateFile(
       std::unique_ptr<DownloadSaveInfo> save_info,
       const base::FilePath& default_download_directory,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const net::NetLogWithSource& net_log,
       base::WeakPtr<DownloadDestinationObserver> observer) override;
 
@@ -214,7 +213,7 @@
 DownloadFileWithDelay::DownloadFileWithDelay(
     std::unique_ptr<DownloadSaveInfo> save_info,
     const base::FilePath& default_download_directory,
-    std::unique_ptr<ByteStreamReader> stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const net::NetLogWithSource& net_log,
     base::WeakPtr<DownloadDestinationObserver> observer,
     base::WeakPtr<DownloadFileWithDelayFactory> owner)
@@ -273,7 +272,7 @@
 DownloadFile* DownloadFileWithDelayFactory::CreateFile(
     std::unique_ptr<DownloadSaveInfo> save_info,
     const base::FilePath& default_download_directory,
-    std::unique_ptr<ByteStreamReader> stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const net::NetLogWithSource& net_log,
     base::WeakPtr<DownloadDestinationObserver> observer) {
   return new DownloadFileWithDelay(std::move(save_info),
@@ -309,12 +308,11 @@
 
 class CountingDownloadFile : public DownloadFileImpl {
  public:
-  CountingDownloadFile(
-      std::unique_ptr<DownloadSaveInfo> save_info,
-      const base::FilePath& default_downloads_directory,
-      std::unique_ptr<ByteStreamReader> stream,
-      const net::NetLogWithSource& net_log,
-      base::WeakPtr<DownloadDestinationObserver> observer)
+  CountingDownloadFile(std::unique_ptr<DownloadSaveInfo> save_info,
+                       const base::FilePath& default_downloads_directory,
+                       std::unique_ptr<DownloadManager::InputStream> stream,
+                       const net::NetLogWithSource& net_log,
+                       base::WeakPtr<DownloadDestinationObserver> observer)
       : DownloadFileImpl(std::move(save_info),
                          default_downloads_directory,
                          std::move(stream),
@@ -370,7 +368,7 @@
   DownloadFile* CreateFile(
       std::unique_ptr<DownloadSaveInfo> save_info,
       const base::FilePath& default_downloads_directory,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const net::NetLogWithSource& net_log,
       base::WeakPtr<DownloadDestinationObserver> observer) override {
     return new CountingDownloadFile(std::move(save_info),

diff --git a/content/browser/download/download_file.h b/content/browser/download/download_file.h
index 8f6ae96..d54d410 100644
--- a/content/browser/download/download_file.h
+++ b/content/browser/download/download_file.h

@@ -15,14 +15,13 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_item.h"
+#include "content/public/browser/download_manager.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 
 class GURL;
 
 namespace content {
 
-class ByteStreamReader;
-
 // These objects live exclusively on the download sequence and handle the
 // writing operations for one download. These objects live only for the duration
 // that the download is 'in progress': once the download has been completed or
@@ -57,15 +56,10 @@
                           const DownloadItem::ReceivedSlices& received_slices,
                           bool is_parallelizable) = 0;
 
-  // Add a byte stream reader to write into a slice of the file, used for
-  // parallel download. Called on the file thread.
-  virtual void AddByteStream(std::unique_ptr<ByteStreamReader> stream_reader,
-                             int64_t offset,
-                             int64_t length) = 0;
-
-  // Add the consumer handle of a DataPipe to write into a slice of the file.
-  virtual void AddDataPipeConsumerHandle(
-      mojo::ScopedDataPipeConsumerHandle handle,
+  // Add an input stream to write into a slice of the file, used for
+  // parallel download.
+  virtual void AddInputStream(
+      std::unique_ptr<DownloadManager::InputStream> stream,
       int64_t offset,
       int64_t length) = 0;
 

diff --git a/content/browser/download/download_file_factory.cc b/content/browser/download/download_file_factory.cc
index 393da35a..db80e1f 100644
--- a/content/browser/download/download_file_factory.cc
+++ b/content/browser/download/download_file_factory.cc

@@ -15,11 +15,11 @@
 DownloadFile* DownloadFileFactory::CreateFile(
     std::unique_ptr<DownloadSaveInfo> save_info,
     const base::FilePath& default_downloads_directory,
-    std::unique_ptr<ByteStreamReader> byte_stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const net::NetLogWithSource& net_log,
     base::WeakPtr<DownloadDestinationObserver> observer) {
   return new DownloadFileImpl(std::move(save_info), default_downloads_directory,
-                              std::move(byte_stream), net_log, observer);
+                              std::move(stream), net_log, observer);
 }
 
 }  // namespace content

diff --git a/content/browser/download/download_file_factory.h b/content/browser/download/download_file_factory.h
index 5c0ec4d..832c707 100644
--- a/content/browser/download/download_file_factory.h
+++ b/content/browser/download/download_file_factory.h

@@ -12,6 +12,7 @@
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "content/browser/download/url_download_handler.h"
 #include "content/common/content_export.h"
 #include "url/gurl.h"
 
@@ -21,7 +22,6 @@
 
 namespace content {
 
-class ByteStreamReader;
 class DownloadDestinationObserver;
 class DownloadFile;
 struct DownloadSaveInfo;
@@ -33,7 +33,7 @@
   virtual DownloadFile* CreateFile(
       std::unique_ptr<DownloadSaveInfo> save_info,
       const base::FilePath& default_downloads_directory,
-      std::unique_ptr<ByteStreamReader> byte_stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const net::NetLogWithSource& net_log,
       base::WeakPtr<DownloadDestinationObserver> observer);
 };

diff --git a/content/browser/download/download_file_impl.cc b/content/browser/download/download_file_impl.cc
index 0d5c006..0b6ad745 100644
--- a/content/browser/download/download_file_impl.cc
+++ b/content/browser/download/download_file_impl.cc

@@ -20,6 +20,7 @@
 #include "content/browser/download/download_interrupt_reasons_impl.h"
 #include "content/browser/download/download_net_log_parameters.h"
 #include "content/browser/download/download_stats.h"
+#include "content/browser/download/download_utils.h"
 #include "content/browser/download/parallel_download_utils.h"
 #include "content/public/browser/browser_thread.h"
 #include "crypto/secure_hash.h"
@@ -61,41 +62,43 @@
 DownloadFileImpl::SourceStream::SourceStream(
     int64_t offset,
     int64_t length,
-    std::unique_ptr<ByteStreamReader> stream_reader)
+    std::unique_ptr<DownloadManager::InputStream> stream)
     : offset_(offset),
       length_(length),
       bytes_written_(0),
       finished_(false),
       index_(0u),
-      stream_reader_(std::move(stream_reader)),
-      completion_status_(DOWNLOAD_INTERRUPT_REASON_NONE),
-      is_response_completed_(false) {}
-
-DownloadFileImpl::SourceStream::SourceStream(
-    int64_t offset,
-    int64_t length,
-    mojo::ScopedDataPipeConsumerHandle consumer_handle)
-    : offset_(offset),
-      length_(length),
-      bytes_written_(0),
-      finished_(false),
-      index_(0u),
+      stream_reader_(std::move(stream->stream_reader_)),
       completion_status_(DOWNLOAD_INTERRUPT_REASON_NONE),
       is_response_completed_(false),
-      consumer_handle_(std::move(consumer_handle)),
-      handle_watcher_(base::MakeUnique<mojo::SimpleWatcher>(
-          FROM_HERE,
-          mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC)) {}
+      stream_handle_(std::move(stream->stream_handle_)) {}
 
 DownloadFileImpl::SourceStream::~SourceStream() = default;
 
-void DownloadFileImpl::SourceStream::OnResponseCompleted(
-    DownloadInterruptReason status) {
+void DownloadFileImpl::SourceStream::Initialize() {
+  if (stream_handle_.is_null())
+    return;
+  binding_ = base::MakeUnique<mojo::Binding<mojom::DownloadStreamClient>>(
+      this, std::move(stream_handle_->client_request));
+  binding_->set_connection_error_handler(base::Bind(
+      &DownloadFileImpl::SourceStream::OnStreamCompleted,
+      base::Unretained(this), mojom::NetworkRequestStatus::USER_CANCELED));
+  handle_watcher_ = base::MakeUnique<mojo::SimpleWatcher>(
+      FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC);
+}
+
+void DownloadFileImpl::SourceStream::OnStreamCompleted(
+    mojom::NetworkRequestStatus status) {
   // This can be called before or after data pipe is completely drained. So we
   // need to pass the |completion_status_| to DownloadFileImpl if the data pipe
   // is already drained.
+  OnResponseCompleted(ConvertMojoNetworkRequestStatusToInterruptReason(status));
+}
+
+void DownloadFileImpl::SourceStream::OnResponseCompleted(
+    DownloadInterruptReason reason) {
   is_response_completed_ = true;
-  completion_status_ = status;
+  completion_status_ = reason;
   if (completion_callback_)
     std::move(completion_callback_).Run(this);
 }
@@ -128,8 +131,8 @@
 void DownloadFileImpl::SourceStream::RegisterDataReadyCallback(
     const mojo::SimpleWatcher::ReadyCallback& callback) {
   if (handle_watcher_) {
-    handle_watcher_->Watch(consumer_handle_.get(), MOJO_HANDLE_SIGNAL_READABLE,
-                           callback);
+    handle_watcher_->Watch(stream_handle_->stream.get(),
+                           MOJO_HANDLE_SIGNAL_READABLE, callback);
   } else if (stream_reader_) {
     stream_reader_->RegisterCallback(base::Bind(callback, MOJO_RESULT_OK));
   }
@@ -159,7 +162,7 @@
   if (handle_watcher_) {
     *length = kBytesToRead;
     *data = new net::IOBuffer(kBytesToRead);
-    MojoResult mojo_result = consumer_handle_->ReadData(
+    MojoResult mojo_result = stream_handle_->stream->ReadData(
         (*data)->data(), (uint32_t*)length, MOJO_READ_DATA_FLAG_NONE);
     // TODO(qinmin): figure out when COMPLETE should be returned.
     switch (mojo_result) {
@@ -170,7 +173,7 @@
       case MOJO_RESULT_FAILED_PRECONDITION:
         if (is_response_completed_)
           return COMPLETE;
-        consumer_handle_.reset();
+        stream_handle_->stream.reset();
         ClearDataReadyCallback();
         return WAIT_FOR_COMPLETION;
       case MOJO_RESULT_INVALID_ARGUMENT:
@@ -196,7 +199,7 @@
 DownloadFileImpl::DownloadFileImpl(
     std::unique_ptr<DownloadSaveInfo> save_info,
     const base::FilePath& default_download_directory,
-    std::unique_ptr<ByteStreamReader> stream_reader,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const net::NetLogWithSource& download_item_net_log,
     base::WeakPtr<DownloadDestinationObserver> observer)
     : DownloadFileImpl(std::move(save_info),
@@ -204,21 +207,7 @@
                        download_item_net_log,
                        observer) {
   source_streams_[save_info_->offset] = base::MakeUnique<SourceStream>(
-      save_info_->offset, save_info_->length, std::move(stream_reader));
-}
-
-DownloadFileImpl::DownloadFileImpl(
-    std::unique_ptr<DownloadSaveInfo> save_info,
-    const base::FilePath& default_download_directory,
-    mojo::ScopedDataPipeConsumerHandle consumer_handle,
-    const net::NetLogWithSource& download_item_net_log,
-    base::WeakPtr<DownloadDestinationObserver> observer)
-    : DownloadFileImpl(std::move(save_info),
-                       default_download_directory,
-                       download_item_net_log,
-                       observer) {
-  source_streams_[save_info_->offset] = base::MakeUnique<SourceStream>(
-      save_info_->offset, save_info_->length, std::move(consumer_handle));
+      save_info_->offset, save_info_->length, std::move(stream));
 }
 
 DownloadFileImpl::DownloadFileImpl(
@@ -284,7 +273,6 @@
                             base::BindOnce(initialize_callback, result));
     return;
   }
-
   download_start_ = base::TimeTicks::Now();
   last_update_time_ = download_start_;
   record_stream_bandwidth_ = is_parallelizable;
@@ -301,30 +289,19 @@
     RegisterAndActivateStream(source_stream.second.get());
 }
 
-void DownloadFileImpl::AddByteStream(
-    std::unique_ptr<ByteStreamReader> stream_reader,
+void DownloadFileImpl::AddInputStream(
+    std::unique_ptr<DownloadManager::InputStream> stream,
     int64_t offset,
     int64_t length) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   source_streams_[offset] =
-      base::MakeUnique<SourceStream>(offset, length, std::move(stream_reader));
-  OnSourceStreamAdded(source_streams_[offset].get());
-}
-
-void DownloadFileImpl::AddDataPipeConsumerHandle(
-    mojo::ScopedDataPipeConsumerHandle consumer_handle,
-    int64_t offset,
-    int64_t length) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-
-  source_streams_[offset] = base::MakeUnique<SourceStream>(
-      offset, length, std::move(consumer_handle));
+      base::MakeUnique<SourceStream>(offset, length, std::move(stream));
   OnSourceStreamAdded(source_streams_[offset].get());
 }
 
 void DownloadFileImpl::OnResponseCompleted(int64_t offset,
-                         DownloadInterruptReason status) {
+                                           DownloadInterruptReason status) {
   auto iter = source_streams_.find(offset);
   if (iter != source_streams_.end())
     iter->second->OnResponseCompleted(status);
@@ -552,7 +529,6 @@
   // Take care of any file local activity required.
   do {
     state = source_stream->Read(&incoming_data, &incoming_data_size);
-
     switch (state) {
       case SourceStream::EMPTY:
         should_terminate = (source_stream->length() == kNoBytesToWrite);
@@ -690,6 +666,7 @@
 void DownloadFileImpl::RegisterAndActivateStream(SourceStream* source_stream) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
+  source_stream->Initialize();
   source_stream->RegisterDataReadyCallback(
       base::Bind(&DownloadFileImpl::StreamActive, weak_factory_.GetWeakPtr(),
                  source_stream));

diff --git a/content/browser/download/download_file_impl.h b/content/browser/download/download_file_impl.h
index bfd5174..e28d39f 100644
--- a/content/browser/download/download_file_impl.h
+++ b/content/browser/download/download_file_impl.h

@@ -27,6 +27,8 @@
 #include "content/browser/download/rate_estimator.h"
 #include "content/public/browser/download_item.h"
 #include "content/public/browser/download_save_info.h"
+#include "content/public/common/download_stream.mojom.h"
+#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "net/log/net_log_with_source.h"
 
@@ -42,16 +44,11 @@
   // (including destruction) must occur in the same sequence.
   //
   // Note that the DownloadFileImpl automatically reads from the passed in
-  // |stream_reader| or |consumer_handle|, and sends updates and status of
-  // those reads to the DownloadDestinationObserver.
+  // |stream|, and sends updates and status of those reads to the
+  // DownloadDestinationObserver.
   DownloadFileImpl(std::unique_ptr<DownloadSaveInfo> save_info,
                    const base::FilePath& default_downloads_directory,
-                   std::unique_ptr<ByteStreamReader> stream_reader,
-                   const net::NetLogWithSource& net_log,
-                   base::WeakPtr<DownloadDestinationObserver> observer);
-  DownloadFileImpl(std::unique_ptr<DownloadSaveInfo> save_info,
-                   const base::FilePath& default_downloads_directory,
-                   mojo::ScopedDataPipeConsumerHandle consumer_handle,
+                   std::unique_ptr<DownloadManager::InputStream> stream,
                    const net::NetLogWithSource& net_log,
                    base::WeakPtr<DownloadDestinationObserver> observer);
 
@@ -62,12 +59,9 @@
                   const CancelRequestCallback& cancel_request_callback,
                   const DownloadItem::ReceivedSlices& received_slices,
                   bool is_parallelizable) override;
-  void AddByteStream(std::unique_ptr<ByteStreamReader> stream_reader,
-                     int64_t offset,
-                     int64_t length) override;
-  void AddDataPipeConsumerHandle(mojo::ScopedDataPipeConsumerHandle handle,
-                                 int64_t offset,
-                                 int64_t length) override;
+  void AddInputStream(std::unique_ptr<DownloadManager::InputStream> stream,
+                      int64_t offset,
+                      int64_t length) override;
   void OnResponseCompleted(int64_t offset,
                            DownloadInterruptReason status) override;
   void RenameAndUniquify(const base::FilePath& full_path,
@@ -108,21 +102,24 @@
   // data needed to write to a slice of the target file.
   //
   // Does not require the stream reader or the consumer handle to be ready when
-  // constructor is called. |stream_reader_| can be set later when the network
-  // response is handled.
+  // constructor is called. They can be added later when the network response
+  // is handled.
   //
   // Multiple SourceStreams can concurrently write to the same file sink.
-  class CONTENT_EXPORT SourceStream {
+  class CONTENT_EXPORT SourceStream : public mojom::DownloadStreamClient {
    public:
     SourceStream(int64_t offset,
                  int64_t length,
-                 std::unique_ptr<ByteStreamReader> stream_reader);
-    SourceStream(int64_t offset,
-                 int64_t length,
-                 mojo::ScopedDataPipeConsumerHandle consumer_handle);
-    ~SourceStream();
+                 std::unique_ptr<DownloadManager::InputStream> stream);
+    ~SourceStream() override;
 
-    void OnResponseCompleted(DownloadInterruptReason status);
+    void Initialize();
+
+    // mojom::DownloadStreamClient
+    void OnStreamCompleted(mojom::NetworkRequestStatus status) override;
+
+    // Called when response is completed.
+    void OnResponseCompleted(DownloadInterruptReason reason);
 
     // Called after successfully writing a buffer to disk.
     void OnWriteBytesToDisk(int64_t bytes_write);
@@ -200,8 +197,10 @@
 
     CompletionCallback completion_callback_;
 
-    mojo::ScopedDataPipeConsumerHandle consumer_handle_;
+    // Objects for consuming a mojo data pipe.
+    mojom::DownloadStreamHandlePtr stream_handle_;
     std::unique_ptr<mojo::SimpleWatcher> handle_watcher_;
+    std::unique_ptr<mojo::Binding<mojom::DownloadStreamClient>> binding_;
 
     DISALLOW_COPY_AND_ASSIGN(SourceStream);
   };

diff --git a/content/browser/download/download_file_unittest.cc b/content/browser/download/download_file_unittest.cc
index e191b629..64192135 100644
--- a/content/browser/download/download_file_unittest.cc
+++ b/content/browser/download/download_file_unittest.cc

@@ -118,12 +118,11 @@
 // retries renames failed due to ACCESS_DENIED.
 class TestDownloadFileImpl : public DownloadFileImpl {
  public:
-  TestDownloadFileImpl(
-      std::unique_ptr<DownloadSaveInfo> save_info,
-      const base::FilePath& default_downloads_directory,
-      std::unique_ptr<ByteStreamReader> stream,
-      const net::NetLogWithSource& net_log,
-      base::WeakPtr<DownloadDestinationObserver> observer)
+  TestDownloadFileImpl(std::unique_ptr<DownloadSaveInfo> save_info,
+                       const base::FilePath& default_downloads_directory,
+                       std::unique_ptr<DownloadManager::InputStream> stream,
+                       const net::NetLogWithSource& net_log,
+                       base::WeakPtr<DownloadDestinationObserver> observer)
       : DownloadFileImpl(std::move(save_info),
                          default_downloads_directory,
                          std::move(stream),
@@ -229,7 +228,8 @@
 
     download_file_.reset(new TestDownloadFileImpl(
         std::move(save_info), base::FilePath(),
-        std::unique_ptr<ByteStreamReader>(input_stream_),
+        base::MakeUnique<DownloadManager::InputStream>(
+            std::unique_ptr<ByteStreamReader>(input_stream_)),
         net::NetLogWithSource(), observer_factory_.GetWeakPtr()));
 
     EXPECT_CALL(*input_stream_, Read(_, _))
@@ -918,8 +918,9 @@
   EXPECT_CALL(*(observer_.get()), MockDestinationCompleted(_, _));
 
   // Activate the streams.
-  download_file_->AddByteStream(
-      std::unique_ptr<MockByteStreamReader>(additional_streams_[0]),
+  download_file_->AddInputStream(
+      base::MakeUnique<DownloadManager::InputStream>(
+          std::unique_ptr<ByteStreamReader>(additional_streams_[0])),
       stream_0_length, DownloadSaveInfo::kLengthFullContent);
   sink_callback_.Run();
   base::RunLoop().RunUntilIdle();
@@ -964,11 +965,13 @@
   EXPECT_CALL(*(observer_.get()), MockDestinationCompleted(_, _));
 
   // Activate all the streams.
-  download_file_->AddByteStream(
-      std::unique_ptr<MockByteStreamReader>(additional_streams_[0]),
+  download_file_->AddInputStream(
+      base::MakeUnique<DownloadManager::InputStream>(
+          std::unique_ptr<ByteStreamReader>(additional_streams_[0])),
       stream_0_length, stream_1_length);
-  download_file_->AddByteStream(
-      std::unique_ptr<MockByteStreamReader>(additional_streams_[1]),
+  download_file_->AddInputStream(
+      base::MakeUnique<DownloadManager::InputStream>(
+          std::unique_ptr<ByteStreamReader>(additional_streams_[1])),
       stream_0_length + stream_1_length, DownloadSaveInfo::kLengthFullContent);
   sink_callback_.Run();
   base::RunLoop().RunUntilIdle();
@@ -1008,8 +1011,9 @@
   EXPECT_FALSE(download_file_->InProgress());
 
   additional_streams_[0] = new StrictMock<MockByteStreamReader>();
-  download_file_->AddByteStream(
-      std::unique_ptr<MockByteStreamReader>(additional_streams_[0]),
+  download_file_->AddInputStream(
+      base::MakeUnique<DownloadManager::InputStream>(
+          std::unique_ptr<ByteStreamReader>(additional_streams_[0])),
       stream_0_length - 1, DownloadSaveInfo::kLengthFullContent);
   base::RunLoop().RunUntilIdle();
 
@@ -1048,9 +1052,10 @@
       .WillOnce(Return(ByteStreamReader::STREAM_EMPTY))
       .RetiresOnSaturation();
 
-  download_file_->AddByteStream(
-      std::unique_ptr<MockByteStreamReader>(additional_streams_[0]), 0,
-      DownloadSaveInfo::kLengthFullContent);
+  download_file_->AddInputStream(
+      base::MakeUnique<DownloadManager::InputStream>(
+          std::unique_ptr<ByteStreamReader>(additional_streams_[0])),
+      0, DownloadSaveInfo::kLengthFullContent);
 
   // The stream should get terminated and reset the callback.
   EXPECT_TRUE(sink_callback_.is_null());

diff --git a/content/browser/download/download_interrupt_reasons_impl.cc b/content/browser/download/download_interrupt_reasons_impl.cc
index b76a15ec..a21bf42 100644
--- a/content/browser/download/download_interrupt_reasons_impl.cc
+++ b/content/browser/download/download_interrupt_reasons_impl.cc

@@ -121,6 +121,36 @@
   return DOWNLOAD_INTERRUPT_REASON_NONE;
 }
 
+DownloadInterruptReason ConvertMojoNetworkRequestStatusToInterruptReason(
+    mojom::NetworkRequestStatus status) {
+  switch (status) {
+    case mojom::NetworkRequestStatus::OK:
+      return DOWNLOAD_INTERRUPT_REASON_NONE;
+    case mojom::NetworkRequestStatus::NETWORK_TIMEOUT:
+      return DOWNLOAD_INTERRUPT_REASON_NETWORK_TIMEOUT;
+    case mojom::NetworkRequestStatus::NETWORK_DISCONNECTED:
+      return DOWNLOAD_INTERRUPT_REASON_NETWORK_DISCONNECTED;
+    case mojom::NetworkRequestStatus::NETWORK_SERVER_DOWN:
+      return DOWNLOAD_INTERRUPT_REASON_NETWORK_SERVER_DOWN;
+    case mojom::NetworkRequestStatus::SERVER_NO_RANGE:
+      return DOWNLOAD_INTERRUPT_REASON_SERVER_NO_RANGE;
+    case mojom::NetworkRequestStatus::SERVER_CONTENT_LENGTH_MISMATCH:
+      return DOWNLOAD_INTERRUPT_REASON_SERVER_CONTENT_LENGTH_MISMATCH;
+    case mojom::NetworkRequestStatus::SERVER_UNREACHABLE:
+      return DOWNLOAD_INTERRUPT_REASON_SERVER_UNREACHABLE;
+    case mojom::NetworkRequestStatus::SERVER_CERT_PROBLEM:
+      return DOWNLOAD_INTERRUPT_REASON_SERVER_CERT_PROBLEM;
+    case mojom::NetworkRequestStatus::USER_CANCELED:
+      return DOWNLOAD_INTERRUPT_REASON_USER_CANCELED;
+    case mojom::NetworkRequestStatus::NETWORK_FAILED:
+      return DOWNLOAD_INTERRUPT_REASON_NETWORK_FAILED;
+    default:
+      NOTREACHED();
+      break;
+  }
+  return DOWNLOAD_INTERRUPT_REASON_NONE;
+}
+
 std::string DownloadInterruptReasonToString(DownloadInterruptReason error) {
 
 #define INTERRUPT_REASON(name, value)  \

diff --git a/content/browser/download/download_interrupt_reasons_impl.h b/content/browser/download/download_interrupt_reasons_impl.h
index 61ccae1a..594470e 100644
--- a/content/browser/download/download_interrupt_reasons_impl.h
+++ b/content/browser/download/download_interrupt_reasons_impl.h

@@ -7,6 +7,7 @@
 
 #include "base/files/file.h"
 #include "content/public/browser/download_interrupt_reasons.h"
+#include "content/public/common/download_stream.mojom.h"
 #include "net/base/net_errors.h"
 
 namespace content {
@@ -27,6 +28,11 @@
 DownloadInterruptReason CONTENT_EXPORT ConvertFileErrorToInterruptReason(
     base::File::Error file_error);
 
+// Safe to call from any thread.
+DownloadInterruptReason CONTENT_EXPORT
+ConvertMojoNetworkRequestStatusToInterruptReason(
+    mojom::NetworkRequestStatus status);
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_DOWNLOAD_DOWNLOAD_INTERRUPT_REASONS_IMPL_H_

diff --git a/content/browser/download/download_job.cc b/content/browser/download/download_job.cc
index 4120848..30e0d43 100644
--- a/content/browser/download/download_job.cc
+++ b/content/browser/download/download_job.cc

@@ -67,9 +67,10 @@
   callback.Run(result);
 }
 
-bool DownloadJob::AddByteStream(std::unique_ptr<ByteStreamReader> stream_reader,
-                                int64_t offset,
-                                int64_t length) {
+bool DownloadJob::AddInputStream(
+    std::unique_ptr<DownloadManager::InputStream> stream,
+    int64_t offset,
+    int64_t length) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DownloadFile* download_file = download_item_->download_file_.get();
   if (!download_file)
@@ -79,9 +80,9 @@
   // deleted on the download task runner after download_file_ is nulled out.
   // So it's safe to use base::Unretained here.
   GetDownloadTaskRunner()->PostTask(
-      FROM_HERE, base::BindOnce(&DownloadFile::AddByteStream,
+      FROM_HERE, base::BindOnce(&DownloadFile::AddInputStream,
                                 base::Unretained(download_file),
-                                base::Passed(&stream_reader), offset, length));
+                                std::move(stream), offset, length));
   return true;
 }
 

diff --git a/content/browser/download/download_job.h b/content/browser/download/download_job.h
index 1398ea78..dcf15e6 100644
--- a/content/browser/download/download_job.h
+++ b/content/browser/download/download_job.h

@@ -66,11 +66,11 @@
       const DownloadFile::InitializeCallback& callback,
       DownloadInterruptReason result);
 
-  // Add a byte stream to the download sink. Return false if we start to
+  // Add an input stream to the download sink. Return false if we start to
   // destroy download file.
-  bool AddByteStream(std::unique_ptr<ByteStreamReader> stream_reader,
-                     int64_t offset,
-                     int64_t length);
+  bool AddInputStream(std::unique_ptr<DownloadManager::InputStream> stream,
+                      int64_t offset,
+                      int64_t length);
 
   DownloadItemImpl* download_item_;
 

diff --git a/content/browser/download/download_manager_impl.cc b/content/browser/download/download_manager_impl.cc
index 4722f36..68e2d509 100644
--- a/content/browser/download/download_manager_impl.cc
+++ b/content/browser/download/download_manager_impl.cc

@@ -129,8 +129,10 @@
     BrowserThread::PostTask(
         BrowserThread::UI, FROM_HERE,
         base::BindOnce(&DownloadManager::StartDownload, download_manager,
-                       base::Passed(&failed_created_info),
-                       base::Passed(&empty_byte_stream), params->callback()));
+                       std::move(failed_created_info),
+                       base::MakeUnique<DownloadManager::InputStream>(
+                           std::move(empty_byte_stream)),
+                       params->callback()));
     return nullptr;
   }
 
@@ -356,13 +358,15 @@
 
 void DownloadManagerImpl::StartDownload(
     std::unique_ptr<DownloadCreateInfo> info,
-    std::unique_ptr<ByteStreamReader> stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const DownloadUrlParameters::OnStartedCallback& on_started) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(info);
+
   // |stream| is only non-nil if the download request was successful.
-  DCHECK((info->result == DOWNLOAD_INTERRUPT_REASON_NONE && stream.get()) ||
-         (info->result != DOWNLOAD_INTERRUPT_REASON_NONE && !stream.get()));
+  DCHECK(
+      (info->result == DOWNLOAD_INTERRUPT_REASON_NONE && !stream->IsEmpty()) ||
+      (info->result != DOWNLOAD_INTERRUPT_REASON_NONE && stream->IsEmpty()));
   DVLOG(20) << __func__
             << "() result=" << DownloadInterruptReasonToString(info->result);
   uint32_t download_id = info->download_id;
@@ -381,7 +385,7 @@
 
 void DownloadManagerImpl::StartDownloadWithId(
     std::unique_ptr<DownloadCreateInfo> info,
-    std::unique_ptr<ByteStreamReader> stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const DownloadUrlParameters::OnStartedCallback& on_started,
     bool new_download,
     uint32_t id) {
@@ -669,7 +673,7 @@
   // TODO(qinmin): remove false from the if statement once download works when
   // network service is enabled, or once we disable the tests that are currently
   // passing with the URLRequest code path.
-  if (base::FeatureList::IsEnabled(features::kNetworkService) && false) {
+  if (base::FeatureList::IsEnabled(features::kNetworkService)) {
     std::unique_ptr<ResourceRequest> request = CreateResourceRequest(
         params.get());
     BrowserThread::PostTaskAndReplyWithResult(
@@ -797,12 +801,9 @@
 
 void DownloadManagerImpl::OnUrlDownloadStarted(
     std::unique_ptr<DownloadCreateInfo> download_create_info,
-    std::unique_ptr<UrlDownloadHandler::InputStream> input_stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const DownloadUrlParameters::OnStartedCallback& callback) {
-  if (!base::FeatureList::IsEnabled(features::kNetworkService)) {
-    StartDownload(std::move(download_create_info),
-                  std::move(input_stream->stream_reader_), callback);
-  }
+  StartDownload(std::move(download_create_info), std::move(stream), callback);
 }
 
 void DownloadManagerImpl::OnUrlDownloadStopped(UrlDownloadHandler* downloader) {

diff --git a/content/browser/download/download_manager_impl.h b/content/browser/download/download_manager_impl.h
index 6e3b37e8..49ca8ed 100644
--- a/content/browser/download/download_manager_impl.h
+++ b/content/browser/download/download_manager_impl.h

@@ -69,7 +69,7 @@
   void GetAllDownloads(DownloadVector* result) override;
   void StartDownload(
       std::unique_ptr<DownloadCreateInfo> info,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const DownloadUrlParameters::OnStartedCallback& on_started) override;
 
   int RemoveDownloadsByURLAndTime(
@@ -117,7 +117,7 @@
   // UrlDownloadHandler::Delegate implementation.
   void OnUrlDownloadStarted(
       std::unique_ptr<DownloadCreateInfo> download_create_info,
-      std::unique_ptr<UrlDownloadHandler::InputStream> input_stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const DownloadUrlParameters::OnStartedCallback& callback) override;
   void OnUrlDownloadStopped(UrlDownloadHandler* downloader) override;
 
@@ -154,7 +154,7 @@
 
   void StartDownloadWithId(
       std::unique_ptr<DownloadCreateInfo> info,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const DownloadUrlParameters::OnStartedCallback& on_started,
       bool new_download,
       uint32_t id);

diff --git a/content/browser/download/download_manager_impl_unittest.cc b/content/browser/download/download_manager_impl_unittest.cc
index 0aedd18..7711f1e 100644
--- a/content/browser/download/download_manager_impl_unittest.cc
+++ b/content/browser/download/download_manager_impl_unittest.cc

@@ -291,15 +291,16 @@
 
   // Overridden method from DownloadFileFactory
   MOCK_METHOD2(MockCreateFile,
-               MockDownloadFile*(const DownloadSaveInfo&, ByteStreamReader*));
+               MockDownloadFile*(const DownloadSaveInfo&,
+                                 DownloadManager::InputStream*));
 
   DownloadFile* CreateFile(
       std::unique_ptr<DownloadSaveInfo> save_info,
       const base::FilePath& default_download_directory,
-      std::unique_ptr<ByteStreamReader> byte_stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const net::NetLogWithSource& net_log,
       base::WeakPtr<DownloadDestinationObserver> observer) override {
-    return MockCreateFile(*save_info, byte_stream.get());
+    return MockCreateFile(*save_info, stream.get());
   }
 };
 
@@ -555,11 +556,13 @@
               ApplicationClientIdForFileScanning())
       .WillRepeatedly(Return("client-id"));
   MockDownloadFile* mock_file = new MockDownloadFile;
+  auto input_stream =
+      base::MakeUnique<DownloadManager::InputStream>(std::move(stream));
   EXPECT_CALL(*mock_download_file_factory_.get(),
-              MockCreateFile(Ref(*info->save_info.get()), stream.get()))
+              MockCreateFile(Ref(*info->save_info.get()), input_stream.get()))
       .WillOnce(Return(mock_file));
 
-  download_manager_->StartDownload(std::move(info), std::move(stream),
+  download_manager_->StartDownload(std::move(info), std::move(input_stream),
                                    DownloadUrlParameters::OnStartedCallback());
   EXPECT_TRUE(download_manager_->GetDownload(local_id));
 }

diff --git a/content/browser/download/download_resource_handler.cc b/content/browser/download/download_resource_handler.cc
index ff55776..d8a680d 100644
--- a/content/browser/download/download_resource_handler.cc
+++ b/content/browser/download/download_resource_handler.cc

@@ -79,8 +79,10 @@
   info->tab_referrer_url = tab_info->tab_referrer_url;
   info->site_url = frame_host->GetSiteInstance()->GetSiteURL();
 
-  download_manager->StartDownload(std::move(info), std::move(stream),
-                                  started_cb);
+  download_manager->StartDownload(
+      std::move(info),
+      base::MakeUnique<DownloadManager::InputStream>(std::move(stream)),
+      started_cb);
 }
 
 void InitializeDownloadTabInfoOnUIThread(

diff --git a/content/browser/download/download_response_handler.cc b/content/browser/download/download_response_handler.cc
index ab85646b..6b16a02d7 100644
--- a/content/browser/download/download_response_handler.cc
+++ b/content/browser/download/download_response_handler.cc

@@ -7,41 +7,119 @@
 #include "content/browser/download/download_stats.h"
 #include "content/browser/download/download_utils.h"
 #include "content/public/browser/download_url_parameters.h"
+#include "net/log/net_log_with_source.h"
 
 namespace content {
 
+namespace {
+
+mojom::NetworkRequestStatus ConvertInterruptReasonToMojoNetworkRequestStatus(
+    DownloadInterruptReason reason) {
+  switch (reason) {
+    case DOWNLOAD_INTERRUPT_REASON_NONE:
+      return mojom::NetworkRequestStatus::OK;
+    case DOWNLOAD_INTERRUPT_REASON_NETWORK_TIMEOUT:
+      return mojom::NetworkRequestStatus::NETWORK_TIMEOUT;
+    case DOWNLOAD_INTERRUPT_REASON_NETWORK_DISCONNECTED:
+      return mojom::NetworkRequestStatus::NETWORK_DISCONNECTED;
+    case DOWNLOAD_INTERRUPT_REASON_NETWORK_SERVER_DOWN:
+      return mojom::NetworkRequestStatus::NETWORK_SERVER_DOWN;
+    case DOWNLOAD_INTERRUPT_REASON_SERVER_NO_RANGE:
+      return mojom::NetworkRequestStatus::SERVER_NO_RANGE;
+    case DOWNLOAD_INTERRUPT_REASON_SERVER_CONTENT_LENGTH_MISMATCH:
+      return mojom::NetworkRequestStatus::SERVER_CONTENT_LENGTH_MISMATCH;
+    case DOWNLOAD_INTERRUPT_REASON_SERVER_UNREACHABLE:
+      return mojom::NetworkRequestStatus::SERVER_UNREACHABLE;
+    case DOWNLOAD_INTERRUPT_REASON_SERVER_CERT_PROBLEM:
+      return mojom::NetworkRequestStatus::SERVER_CERT_PROBLEM;
+    case DOWNLOAD_INTERRUPT_REASON_USER_CANCELED:
+      return mojom::NetworkRequestStatus::USER_CANCELED;
+    case DOWNLOAD_INTERRUPT_REASON_NETWORK_FAILED:
+      return mojom::NetworkRequestStatus::NETWORK_FAILED;
+    default:
+      NOTREACHED();
+      return mojom::NetworkRequestStatus::NETWORK_FAILED;
+  }
+}
+
+}  // namespace
+
 DownloadResponseHandler::DownloadResponseHandler(DownloadUrlParameters* params,
                                                  Delegate* delegate,
                                                  bool is_parallel_request)
-    : delegate_(delegate) {
+    : delegate_(delegate),
+      started_(false),
+      save_info_(base::MakeUnique<DownloadSaveInfo>(params->GetSaveInfo())),
+      url_chain_(1, params->url()),
+      guid_(params->guid()),
+      method_(params->method()),
+      referrer_(params->referrer().url),
+      is_transient_(params->is_transient()),
+      has_strong_validators_(false) {
   if (!is_parallel_request)
     RecordDownloadCount(UNTHROTTLED_COUNT);
-
-  // TODO(qinmin): create the DownloadSaveInfo from |params|
 }
 
 DownloadResponseHandler::~DownloadResponseHandler() = default;
 
 void DownloadResponseHandler::OnReceiveResponse(
-    const content::ResourceResponseHead& head,
+    const ResourceResponseHead& head,
     const base::Optional<net::SSLInfo>& ssl_info,
     mojom::DownloadedTempFilePtr downloaded_file) {
-  // TODO(qinmin): create the DownloadCreateInfo from |head|.
+  if (head.headers)
+    RecordDownloadHttpResponseCode(head.headers->response_code());
 
-  // TODO(qinmin): pass DownloadSaveInfo here.
+  create_info_ = CreateDownloadCreateInfo(head);
+
+  if (ssl_info)
+    cert_status_ = ssl_info->cert_status;
+
+  if (head.headers)
+    has_strong_validators_ = head.headers->HasStrongValidators();
+
+  if (create_info_->result != DOWNLOAD_INTERRUPT_REASON_NONE)
+    OnResponseStarted(mojom::DownloadStreamHandlePtr());
+}
+
+std::unique_ptr<DownloadCreateInfo>
+DownloadResponseHandler::CreateDownloadCreateInfo(
+    const ResourceResponseHead& head) {
+  // TODO(qinmin): instead of using NetLogWithSource, introduce new logging
+  // class for download.
+  auto create_info = base::MakeUnique<DownloadCreateInfo>(
+      base::Time::Now(), net::NetLogWithSource(), std::move(save_info_));
+
   DownloadInterruptReason result =
-      head.headers
-          ? HandleSuccessfulServerResponse(*(head.headers.get()), nullptr)
-          : DOWNLOAD_INTERRUPT_REASON_NONE;
-  if (result != DOWNLOAD_INTERRUPT_REASON_NONE) {
-    delegate_->OnResponseStarted(base::MakeUnique<DownloadCreateInfo>(),
-                                 mojo::ScopedDataPipeConsumerHandle());
+      head.headers ? HandleSuccessfulServerResponse(
+                         *head.headers, create_info->save_info.get())
+                   : DOWNLOAD_INTERRUPT_REASON_NONE;
+
+  create_info->result = result;
+  if (result == DOWNLOAD_INTERRUPT_REASON_NONE)
+    create_info->remote_address = head.socket_address.host();
+  create_info->method = method_;
+  create_info->connection_info = head.connection_info;
+  create_info->url_chain = url_chain_;
+  create_info->referrer_url = referrer_;
+  create_info->guid = guid_;
+  create_info->transient = is_transient_;
+  create_info->response_headers = head.headers;
+  create_info->offset = create_info->save_info->offset;
+  create_info->mime_type = head.mime_type;
+  if (head.headers &&
+      !head.headers->GetMimeType(&create_info->original_mime_type)) {
+    create_info->original_mime_type.clear();
   }
+  return create_info;
 }
 
 void DownloadResponseHandler::OnReceiveRedirect(
     const net::RedirectInfo& redirect_info,
-    const content::ResourceResponseHead& head) {}
+    const content::ResourceResponseHead& head) {
+  url_chain_.push_back(redirect_info.new_url);
+  method_ = redirect_info.new_method;
+  referrer_ = GURL(redirect_info.new_referrer);
+}
 
 void DownloadResponseHandler::OnDataDownloaded(int64_t data_length,
                                                int64_t encoded_length) {}
@@ -55,17 +133,46 @@
     const std::vector<uint8_t>& data) {}
 
 void DownloadResponseHandler::OnTransferSizeUpdated(
-    int32_t transfer_size_diff) {};
+    int32_t transfer_size_diff) {}
 
 void DownloadResponseHandler::OnStartLoadingResponseBody(
     mojo::ScopedDataPipeConsumerHandle body) {
-  delegate_->OnResponseStarted(base::MakeUnique<DownloadCreateInfo>(),
-                               std::move(body));
+  if (started_)
+    return;
+
+  mojom::DownloadStreamHandlePtr stream_handle =
+      mojom::DownloadStreamHandle::New();
+  stream_handle->stream = std::move(body);
+  stream_handle->client_request = mojo::MakeRequest(&client_ptr_);
+  OnResponseStarted(std::move(stream_handle));
 }
 
 void DownloadResponseHandler::OnComplete(
     const content::ResourceRequestCompletionStatus& completion_status) {
-  // TODO(qinmin): passing the |completion_status| to DownloadFile.
+  DownloadInterruptReason reason = HandleRequestCompletionStatus(
+      static_cast<net::Error>(completion_status.error_code),
+      has_strong_validators_, cert_status_, DOWNLOAD_INTERRUPT_REASON_NONE);
+
+  if (client_ptr_) {
+    client_ptr_->OnStreamCompleted(
+        ConvertInterruptReasonToMojoNetworkRequestStatus(reason));
+  }
+
+  if (started_)
+    return;
+
+  // OnComplete() called without OnReceiveResponse(). This should only
+  // happen when the request was aborted.
+  create_info_ = CreateDownloadCreateInfo(ResourceResponseHead());
+  create_info_->result = reason;
+  OnResponseStarted(mojom::DownloadStreamHandlePtr());
+}
+
+void DownloadResponseHandler::OnResponseStarted(
+    mojom::DownloadStreamHandlePtr stream_handle) {
+  started_ = true;
+  delegate_->OnResponseStarted(std::move(create_info_),
+                               std::move(stream_handle));
 }
 
 }  // namespace content

diff --git a/content/browser/download/download_response_handler.h b/content/browser/download/download_response_handler.h
index d3a658cc..f36b086 100644
--- a/content/browser/download/download_response_handler.h
+++ b/content/browser/download/download_response_handler.h

@@ -5,12 +5,20 @@
 #ifndef CONTENT_BROWSER_DOWNLOAD_RESPONSE_HANDLER_
 #define CONTENT_BROWSER_DOWNLOAD_RESPONSE_HANDLER_
 
+#include <vector>
+
 #include "content/browser/download/download_create_info.h"
+#include "content/public/common/download_stream.mojom.h"
+#include "content/public/common/referrer.h"
+#include "content/public/common/resource_response.h"
 #include "content/public/common/url_loader.mojom.h"
+#include "net/cert/cert_status_flags.h"
 
 namespace content {
 
 class DownloadUrlParameters;
+struct DownloadCreateInfo;
+struct DownloadSaveInfo;
 
 // This class is responsible for handling the server response for a download.
 // It passes the DataPipeConsumerHandle and completion status to the download
@@ -18,11 +26,12 @@
 // context menu downloads
 class DownloadResponseHandler : public mojom::URLLoaderClient {
  public:
+  // Class for handling the stream once response starts.
   class Delegate {
    public:
     virtual void OnResponseStarted(
         std::unique_ptr<DownloadCreateInfo> download_create_info,
-        mojo::ScopedDataPipeConsumerHandle body) = 0;
+        mojom::DownloadStreamHandlePtr stream_handle) = 0;
   };
 
   DownloadResponseHandler(DownloadUrlParameters* params,
@@ -31,7 +40,7 @@
   ~DownloadResponseHandler() override;
 
   // mojom::URLLoaderClient
-  void OnReceiveResponse(const content::ResourceResponseHead& head,
+  void OnReceiveResponse(const ResourceResponseHead& head,
                          const base::Optional<net::SSLInfo>& ssl_info,
                          mojom::DownloadedTempFilePtr downloaded_file) override;
   void OnReceiveRedirect(const net::RedirectInfo& redirect_info,
@@ -48,8 +57,31 @@
                   completion_status) override;
 
  private:
+  std::unique_ptr<DownloadCreateInfo> CreateDownloadCreateInfo(
+      const ResourceResponseHead& head);
+
+  // Helper method that is called when response is received.
+  void OnResponseStarted(mojom::DownloadStreamHandlePtr stream_handle);
+
   Delegate* const delegate_;
 
+  std::unique_ptr<DownloadCreateInfo> create_info_;
+
+  bool started_;
+
+  // Information needed to create DownloadCreateInfo when the time comes.
+  std::unique_ptr<DownloadSaveInfo> save_info_;
+  std::vector<GURL> url_chain_;
+  std::string guid_;
+  std::string method_;
+  GURL referrer_;
+  bool is_transient_;
+  net::CertStatus cert_status_;
+  bool has_strong_validators_;
+
+  // Mojo interface ptr to send the completion status to the download sink.
+  mojom::DownloadStreamClientPtr client_ptr_;
+
   DISALLOW_COPY_AND_ASSIGN(DownloadResponseHandler);
 };
 

diff --git a/content/browser/download/download_utils.cc b/content/browser/download/download_utils.cc
index 319a3fa..bb824e7 100644
--- a/content/browser/download/download_utils.cc
+++ b/content/browser/download/download_utils.cc

@@ -212,8 +212,7 @@
   // Add additional request headers.
   std::unique_ptr<net::HttpRequestHeaders> headers =
       GetAdditionalRequestHeaders(params);
-  if (!headers->IsEmpty())
-    request->headers = headers->ToString();
+  request->headers.Swap(headers.get());
 
   return request;
 }

diff --git a/content/browser/download/download_worker.cc b/content/browser/download/download_worker.cc
index b79f3f6..24f770c1 100644
--- a/content/browser/download/download_worker.cc
+++ b/content/browser/download/download_worker.cc

@@ -97,7 +97,7 @@
 
 void DownloadWorker::OnUrlDownloadStarted(
     std::unique_ptr<DownloadCreateInfo> create_info,
-    std::unique_ptr<UrlDownloadHandler::InputStream> input_stream,
+    std::unique_ptr<DownloadManager::InputStream> input_stream,
     const DownloadUrlParameters::OnStartedCallback& callback) {
   // |callback| is not used in subsequent requests.
   DCHECK(callback.is_null());

diff --git a/content/browser/download/download_worker.h b/content/browser/download/download_worker.h
index 81b49089..b9067ac 100644
--- a/content/browser/download/download_worker.h
+++ b/content/browser/download/download_worker.h

@@ -54,7 +54,7 @@
   // UrlDownloader::Delegate implementation.
   void OnUrlDownloadStarted(
       std::unique_ptr<DownloadCreateInfo> create_info,
-      std::unique_ptr<UrlDownloadHandler::InputStream> input_stream,
+      std::unique_ptr<DownloadManager::InputStream> input_stream,
       const DownloadUrlParameters::OnStartedCallback& callback) override;
   void OnUrlDownloadStopped(UrlDownloadHandler* downloader) override;
 

diff --git a/content/browser/download/mock_download_file.cc b/content/browser/download/mock_download_file.cc
index aca43d0..675be1d 100644
--- a/content/browser/download/mock_download_file.cc
+++ b/content/browser/download/mock_download_file.cc

@@ -39,20 +39,13 @@
 MockDownloadFile::~MockDownloadFile() {
 }
 
-void MockDownloadFile::AddByteStream(
-    std::unique_ptr<ByteStreamReader> stream_reader,
+void MockDownloadFile::AddInputStream(
+    std::unique_ptr<DownloadManager::InputStream> input_stream,
     int64_t offset,
     int64_t length) {
   // Gmock currently can't mock method that takes move-only parameters,
   // delegate the EXPECT_CALL count to |DoAddByteStream|.
-  DoAddByteStream(stream_reader.get(), offset, length);
-}
-
-void MockDownloadFile::AddDataPipeConsumerHandle(
-    mojo::ScopedDataPipeConsumerHandle handle,
-    int64_t offset,
-    int64_t length) {
-  DoAddDataPipeConsumerHandle(handle.get(), offset, length);
+  DoAddInputStream(input_stream.get(), offset, length);
 }
 
 }  // namespace content

diff --git a/content/browser/download/mock_download_file.h b/content/browser/download/mock_download_file.h
index 152a932..176047f 100644
--- a/content/browser/download/mock_download_file.h
+++ b/content/browser/download/mock_download_file.h

@@ -33,18 +33,12 @@
                     const CancelRequestCallback&,
                     const DownloadItem::ReceivedSlices& received_slices,
                     bool is_parallelizable));
-  void AddByteStream(std::unique_ptr<ByteStreamReader> stream_reader,
-                     int64_t offset,
-                     int64_t length) override;
-  void AddDataPipeConsumerHandle(mojo::ScopedDataPipeConsumerHandle handle,
-                                 int64_t offset,
-                                 int64_t length) override;
-  MOCK_METHOD3(DoAddDataPipeConsumerHandle,
-               void(const mojo::DataPipeConsumerHandle& handle,
-                    int64_t offset,
-                    int64_t length));
-  MOCK_METHOD3(DoAddByteStream,
-               void(ByteStreamReader* stream_reader,
+  void AddInputStream(
+      std::unique_ptr<DownloadManager::InputStream> input_stream,
+      int64_t offset,
+      int64_t length) override;
+  MOCK_METHOD3(DoAddInputStream,
+               void(DownloadManager::InputStream* input_stream,
                     int64_t offset,
                     int64_t length));
   MOCK_METHOD2(OnResponseCompleted, void(int64_t offset,

diff --git a/content/browser/download/parallel_download_job.cc b/content/browser/download/parallel_download_job.cc
index 30e6258f..0ea7744 100644
--- a/content/browser/download/parallel_download_job.cc
+++ b/content/browser/download/parallel_download_job.cc

@@ -119,8 +119,9 @@
 void ParallelDownloadJob::OnByteStreamReady(
     DownloadWorker* worker,
     std::unique_ptr<ByteStreamReader> stream_reader) {
-  bool success = DownloadJob::AddByteStream(std::move(stream_reader),
-                                            worker->offset(), worker->length());
+  bool success = DownloadJob::AddInputStream(
+      base::MakeUnique<DownloadManager::InputStream>(std::move(stream_reader)),
+      worker->offset(), worker->length());
   RecordParallelDownloadAddStreamSuccess(success);
 
   // Destroy the request if the sink is gone.

diff --git a/content/browser/download/parallel_download_job_unittest.cc b/content/browser/download/parallel_download_job_unittest.cc
index 96f8a6e8..1206815 100644
--- a/content/browser/download/parallel_download_job_unittest.cc
+++ b/content/browser/download/parallel_download_job_unittest.cc

@@ -174,7 +174,7 @@
     create_info->request_handle = std::move(request_handle);
     delegate->OnUrlDownloadStarted(
         std::move(create_info),
-        base::MakeUnique<UrlDownloadHandler::InputStream>(
+        base::MakeUnique<DownloadManager::InputStream>(
             base::MakeUnique<MockByteStreamReader>()),
         DownloadUrlParameters::OnStartedCallback());
   }
@@ -384,8 +384,9 @@
       observer.get());
   auto download_file = base::MakeUnique<DownloadFileImpl>(
       std::move(save_info), base::FilePath(),
-      std::unique_ptr<ByteStreamReader>(input_stream), net::NetLogWithSource(),
-      observer_factory.GetWeakPtr());
+      base::MakeUnique<DownloadManager::InputStream>(
+          std::unique_ptr<ByteStreamReader>(input_stream)),
+      net::NetLogWithSource(), observer_factory.GetWeakPtr());
   CreateParallelJob(0, 100, DownloadItem::ReceivedSlices(), 2, 0, 0);
   job_->Start(download_file.get(),
               base::Bind(&ParallelDownloadJobTest::OnFileInitialized,

diff --git a/content/browser/download/resource_downloader.cc b/content/browser/download/resource_downloader.cc
index bef3f56..1d5c81f 100644
--- a/content/browser/download/resource_downloader.cc
+++ b/content/browser/download/resource_downloader.cc

@@ -7,9 +7,41 @@
 #include "content/browser/download/download_utils.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/common/throttling_url_loader.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
 
 namespace content {
 
+// This class is only used for providing the WebContents to DownloadItemImpl.
+class RequestHandle : public DownloadRequestHandleInterface {
+ public:
+  RequestHandle(int render_process_id, int render_frame_id)
+      : render_process_id_(render_process_id),
+        render_frame_id_(render_frame_id) {}
+  RequestHandle(RequestHandle&& other)
+      : render_process_id_(other.render_process_id_),
+        render_frame_id_(other.render_frame_id_) {}
+
+  // DownloadRequestHandleInterface
+  WebContents* GetWebContents() const override {
+    RenderFrameHost* host =
+        RenderFrameHost::FromID(render_process_id_, render_frame_id_);
+    if (host)
+      return WebContents::FromRenderFrameHost(host);
+    return nullptr;
+  }
+  DownloadManager* GetDownloadManager() const override { return nullptr; }
+  void PauseRequest() const override {}
+  void ResumeRequest() const override {}
+  void CancelRequest(bool user_cancel) const override {}
+
+ private:
+  int render_process_id_;
+  int render_frame_id_;
+
+  DISALLOW_COPY_AND_ASSIGN(RequestHandle);
+};
+
 // static
 std::unique_ptr<ResourceDownloader> ResourceDownloader::BeginDownload(
     base::WeakPtr<UrlDownloadHandler::Delegate> delegate,
@@ -18,9 +50,6 @@
     scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter,
     uint32_t download_id,
     bool is_parallel_request) {
-  if (download_url_parameters->url().SchemeIs(url::kBlobScheme))
-    return nullptr;
-
   auto downloader = base::MakeUnique<ResourceDownloader>(
       delegate, std::move(download_url_parameters), url_loader_factory_getter,
       download_id, is_parallel_request);
@@ -47,9 +76,13 @@
 ResourceDownloader::~ResourceDownloader() = default;
 
 void ResourceDownloader::Start(std::unique_ptr<ResourceRequest> request) {
+  mojom::URLLoaderFactoryPtr* factory =
+      download_url_parameters_->url().SchemeIs(url::kBlobScheme)
+          ? url_loader_factory_getter_->GetBlobFactory()
+          : url_loader_factory_getter_->GetNetworkFactory();
+
   url_loader_ = ThrottlingURLLoader::CreateLoaderAndStart(
-      url_loader_factory_getter_->GetNetworkFactory()->get(),
-      std::vector<std::unique_ptr<URLLoaderThrottle>>(),
+      factory->get(), std::vector<std::unique_ptr<URLLoaderThrottle>>(),
       0,  // routing_id
       0,  // request_id
       mojom::kURLLoadOptionSendSSLInfo | mojom::kURLLoadOptionSniffMimeType,
@@ -59,15 +92,20 @@
 
 void ResourceDownloader::OnResponseStarted(
     std::unique_ptr<DownloadCreateInfo> download_create_info,
-    mojo::ScopedDataPipeConsumerHandle body) {
+    mojom::DownloadStreamHandlePtr stream_handle) {
   download_create_info->download_id = download_id_;
+  if (download_url_parameters_->render_process_host_id() >= 0) {
+    download_create_info->request_handle.reset(new RequestHandle(
+        download_url_parameters_->render_process_host_id(),
+        download_url_parameters_->render_frame_host_routing_id()));
+  }
   BrowserThread::PostTask(
       BrowserThread::UI, FROM_HERE,
-      base::BindOnce(
-          &UrlDownloadHandler::Delegate::OnUrlDownloadStarted, delegate_,
-          std::move(download_create_info),
-          base::MakeUnique<UrlDownloadHandler::InputStream>(std::move(body)),
-          download_url_parameters_->callback()));
+      base::BindOnce(&UrlDownloadHandler::Delegate::OnUrlDownloadStarted,
+                     delegate_, std::move(download_create_info),
+                     base::MakeUnique<DownloadManager::InputStream>(
+                         std::move(stream_handle)),
+                     download_url_parameters_->callback()));
 }
 
 }  // namespace content

diff --git a/content/browser/download/resource_downloader.h b/content/browser/download/resource_downloader.h
index a5925ef..c798a52 100644
--- a/content/browser/download/resource_downloader.h
+++ b/content/browser/download/resource_downloader.h

@@ -39,7 +39,7 @@
   // DownloadResponseHandler::Delegate
   void OnResponseStarted(
       std::unique_ptr<DownloadCreateInfo> download_create_info,
-      mojo::ScopedDataPipeConsumerHandle body) override;
+      mojom::DownloadStreamHandlePtr stream_handle) override;
 
  private:
   // Helper method to start the network request.

diff --git a/content/browser/download/url_download_handler.cc b/content/browser/download/url_download_handler.cc
deleted file mode 100644
index 0a2f5fc..0000000
--- a/content/browser/download/url_download_handler.cc
+++ /dev/null

@@ -1,19 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/download/url_download_handler.h"
-
-namespace content {
-
-UrlDownloadHandler::InputStream::InputStream(
-    std::unique_ptr<ByteStreamReader> stream_reader)
-    : stream_reader_(std::move(stream_reader)) {}
-
-UrlDownloadHandler::InputStream::InputStream(
-    mojo::ScopedDataPipeConsumerHandle body)
-    : body_(std::move(body)) {}
-
-UrlDownloadHandler::InputStream::~InputStream() = default;
-
-}  // namespace content

diff --git a/content/browser/download/url_download_handler.h b/content/browser/download/url_download_handler.h
index 7a7ac1b..2a6fd4d4 100644
--- a/content/browser/download/url_download_handler.h
+++ b/content/browser/download/url_download_handler.h

@@ -6,8 +6,8 @@
 #define CONTENT_BROWSER_DOWNLOAD_URL_DOWNLOAD_HANDLER
 
 #include "content/browser/byte_stream.h"
+#include "content/public/browser/download_manager.h"
 #include "content/public/browser/download_url_parameters.h"
-#include "content/public/common/url_loader.mojom.h"
 
 namespace content {
 
@@ -16,23 +16,12 @@
 // Class for handling the download of a url. Implemented by child classes.
 class CONTENT_EXPORT UrlDownloadHandler {
  public:
-  // InputStream to read after the download starts. Only one of them could be
-  // available at the same time.
-  struct CONTENT_EXPORT InputStream {
-    explicit InputStream(std::unique_ptr<ByteStreamReader> stream_reader);
-    explicit InputStream(mojo::ScopedDataPipeConsumerHandle body);
-    ~InputStream();
-
-    std::unique_ptr<ByteStreamReader> stream_reader_;
-    mojo::ScopedDataPipeConsumerHandle body_;
-  };
-
   // Class to be notified when download starts/stops.
   class CONTENT_EXPORT Delegate {
    public:
     virtual void OnUrlDownloadStarted(
         std::unique_ptr<DownloadCreateInfo> download_create_info,
-        std::unique_ptr<InputStream> input_stream,
+        std::unique_ptr<DownloadManager::InputStream> input_stream,
         const DownloadUrlParameters::OnStartedCallback& callback) = 0;
     // Called after the connection is cancelled or finished.
     virtual void OnUrlDownloadStopped(UrlDownloadHandler* downloader) = 0;

diff --git a/content/browser/download/url_downloader.cc b/content/browser/download/url_downloader.cc
index f240cb63..f6b3a4a6 100644
--- a/content/browser/download/url_downloader.cc
+++ b/content/browser/download/url_downloader.cc

@@ -218,7 +218,7 @@
       BrowserThread::UI, FROM_HERE,
       base::BindOnce(&UrlDownloadHandler::Delegate::OnUrlDownloadStarted,
                      delegate_, std::move(create_info),
-                     base::MakeUnique<UrlDownloadHandler::InputStream>(
+                     base::MakeUnique<DownloadManager::InputStream>(
                          std::move(stream_reader)),
                      callback));
 }

diff --git a/content/browser/frame_host/render_widget_host_view_guest.cc b/content/browser/frame_host/render_widget_host_view_guest.cc
index a1abce1..9cc00d7 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.cc
+++ b/content/browser/frame_host/render_widget_host_view_guest.cc

@@ -451,6 +451,12 @@
   return platform_view_->UnlockMouse();
 }
 
+viz::LocalSurfaceId RenderWidgetHostViewGuest::GetLocalSurfaceId() const {
+  if (guest_)
+    return guest_->local_surface_id();
+  return viz::LocalSurfaceId();
+}
+
 void RenderWidgetHostViewGuest::DidCreateNewRendererCompositorFrameSink(
     viz::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink) {
   RenderWidgetHostViewChildFrame::DidCreateNewRendererCompositorFrameSink(

diff --git a/content/browser/frame_host/render_widget_host_view_guest.h b/content/browser/frame_host/render_widget_host_view_guest.h
index 072ce96..b5b77f5 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.h
+++ b/content/browser/frame_host/render_widget_host_view_guest.h

@@ -107,6 +107,7 @@
 
   bool LockMouse() override;
   void UnlockMouse() override;
+  viz::LocalSurfaceId GetLocalSurfaceId() const override;
   void DidCreateNewRendererCompositorFrameSink(
       viz::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink)
       override;

diff --git a/content/browser/isolated_origin_browsertest.cc b/content/browser/isolated_origin_browsertest.cc
index c516436..c1c9d50 100644
--- a/content/browser/isolated_origin_browsertest.cc
+++ b/content/browser/isolated_origin_browsertest.cc

@@ -508,28 +508,42 @@
 // This class allows intercepting the OpenLocalStorage method and changing
 // the parameters to the real implementation of it.
 class StoragePartitonInterceptor
-    : public mojom::StoragePartitionServiceInterceptorForTesting {
+    : public mojom::StoragePartitionServiceInterceptorForTesting,
+      public RenderProcessHostObserver {
  public:
-  StoragePartitonInterceptor(RenderProcessHostImpl* rph) {
-    // Install a custom callback for handling errors during interface calls.
-    // This is needed because the passthrough calls that this object makes
-    // to the real implementaion of the service don't have the correct
-    // context to invoke the real error callback.
-    mojo::edk::SetDefaultProcessErrorCallback(base::Bind(
-        [](int process_id, const std::string& s) {
-          bad_message::ReceivedBadMessage(process_id,
-                                          bad_message::DSMF_LOAD_STORAGE);
-        },
-        rph->GetID()));
+  StoragePartitonInterceptor(RenderProcessHostImpl* rph,
+                             mojom::StoragePartitionServiceRequest request) {
+    StoragePartitionImpl* storage_partition =
+        static_cast<StoragePartitionImpl*>(rph->GetStoragePartition());
 
-    static_cast<StoragePartitionImpl*>(rph->GetStoragePartition())
-        ->Bind(rph->GetID(), mojo::MakeRequest(&storage_partition_service_));
+    // Bind the real StoragePartitionService implementation.
+    mojo::BindingId binding_id =
+        storage_partition->Bind(rph->GetID(), std::move(request));
+
+    // Now replace it with this object and keep a pointer to the real
+    // implementation.
+    storage_partition_service_ =
+        storage_partition->bindings_for_testing().SwapImplForTesting(binding_id,
+                                                                     this);
+
+    // Register the |this| as a RenderProcessHostObserver, so it can be
+    // correctly cleaned up when the process exits.
+    rph->AddObserver(this);
+  }
+
+  // Ensure this object is cleaned up when the process goes away, since it
+  // is not owned by anyone else.
+  void RenderProcessExited(RenderProcessHost* host,
+                           base::TerminationStatus status,
+                           int exit_code) override {
+    host->RemoveObserver(this);
+    delete this;
   }
 
   // Allow all methods that aren't explicitly overriden to pass through
   // unmodified.
   mojom::StoragePartitionService* GetForwardingInterface() override {
-    return storage_partition_service_.get();
+    return storage_partition_service_;
   }
 
   // Override this method to allow changing the origin. It simulates a
@@ -545,17 +559,15 @@
  private:
   // Keep a pointer to the original implementation of the service, so all
   // calls can be forwarded to it.
-  // Note: When making calls through this object, they are in-process calls,
-  // so state on the receiving side of the call will be missing the real
-  // information of which process has made the real method call.
-  mojom::StoragePartitionServicePtr storage_partition_service_;
+  mojom::StoragePartitionService* storage_partition_service_;
 };
 
 void CreateTestStoragePartitionService(
     RenderProcessHostImpl* rph,
     mojom::StoragePartitionServiceRequest request) {
-  mojo::MakeStrongBinding(base::MakeUnique<StoragePartitonInterceptor>(rph),
-                          std::move(request));
+  // This object will register as RenderProcessHostObserver, so it will
+  // clean itself automatically on process exit.
+  new StoragePartitonInterceptor(rph, std::move(request));
 }
 
 // Verify that an isolated renderer process cannot read localStorage of an

diff --git a/content/browser/loader/navigation_url_loader_network_service.cc b/content/browser/loader/navigation_url_loader_network_service.cc
index 8a9139cc..2c04b2c 100644
--- a/content/browser/loader/navigation_url_loader_network_service.cc
+++ b/content/browser/loader/navigation_url_loader_network_service.cc

@@ -436,7 +436,7 @@
   new_request->request_initiator = request_info->begin_params.initiator_origin;
   new_request->referrer = request_info->common_params.referrer.url;
   new_request->referrer_policy = request_info->common_params.referrer.policy;
-  new_request->headers = request_info->begin_params.headers;
+  new_request->headers.AddHeadersFromString(request_info->begin_params.headers);
 
   int load_flags = request_info->begin_params.load_flags;
   load_flags |= net::LOAD_VERIFY_EV_CERT;

diff --git a/content/browser/loader/resource_dispatcher_host_impl.cc b/content/browser/loader/resource_dispatcher_host_impl.cc
index a3ae030..096839f1 100644
--- a/content/browser/loader/resource_dispatcher_host_impl.cc
+++ b/content/browser/loader/resource_dispatcher_host_impl.cc

@@ -700,71 +700,18 @@
     // the aggregate remainder errors.
     base::TimeDelta request_loading_time(
         base::TimeTicks::Now() - loader->request()->creation_time());
-    switch (loader->request()->status().error()) {
-      case net::OK:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.Success", request_loading_time);
-        break;
-      case net::ERR_ABORTED:
-        UMA_HISTOGRAM_CUSTOM_COUNTS("Net.ErrAborted.SentBytes",
-                                    loader->request()->GetTotalSentBytes(), 1,
-                                    50000000, 50);
-        UMA_HISTOGRAM_CUSTOM_COUNTS("Net.ErrAborted.ReceivedBytes",
-                                    loader->request()->GetTotalReceivedBytes(),
-                                    1, 50000000, 50);
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.ErrAborted", request_loading_time);
+    if (loader->request()->status().error() == net::ERR_ABORTED) {
+      UMA_HISTOGRAM_CUSTOM_COUNTS("Net.ErrAborted.SentBytes",
+                                  loader->request()->GetTotalSentBytes(), 1,
+                                  50000000, 50);
+      UMA_HISTOGRAM_CUSTOM_COUNTS("Net.ErrAborted.ReceivedBytes",
+                                  loader->request()->GetTotalReceivedBytes(), 1,
+                                  50000000, 50);
 
-        if (loader->request()->url().SchemeIsHTTPOrHTTPS()) {
-          UMA_HISTOGRAM_LONG_TIMES("Net.RequestTime2.ErrAborted.HttpScheme",
-                                   request_loading_time);
-        } else {
-          UMA_HISTOGRAM_LONG_TIMES("Net.RequestTime2.ErrAborted.NonHttpScheme",
-                                   request_loading_time);
-        }
-
-        if (loader->request()->GetTotalReceivedBytes() > 0) {
-          UMA_HISTOGRAM_LONG_TIMES("Net.RequestTime2.ErrAborted.NetworkContent",
-                                   request_loading_time);
-        } else if (loader->request()->received_response_content_length() > 0) {
-          UMA_HISTOGRAM_LONG_TIMES(
-              "Net.RequestTime2.ErrAborted.NoNetworkContent.CachedContent",
-              request_loading_time);
-        } else {
-          UMA_HISTOGRAM_LONG_TIMES(
-              "Net.RequestTime2.ErrAborted.NoBytesRead",
-              request_loading_time);
-        }
-
-        if (delegate_) {
-          delegate_->OnAbortedFrameLoad(loader->request()->url(),
-                                        request_loading_time);
-        }
-        break;
-      case net::ERR_CONNECTION_RESET:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.ErrConnectionReset", request_loading_time);
-        break;
-      case net::ERR_CONNECTION_TIMED_OUT:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.ErrConnectionTimedOut", request_loading_time);
-        break;
-      case net::ERR_INTERNET_DISCONNECTED:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.ErrInternetDisconnected", request_loading_time);
-        break;
-      case net::ERR_NAME_NOT_RESOLVED:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.ErrNameNotResolved", request_loading_time);
-        break;
-      case net::ERR_TIMED_OUT:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.ErrTimedOut", request_loading_time);
-        break;
-      default:
-        UMA_HISTOGRAM_LONG_TIMES(
-            "Net.RequestTime2.MiscError", request_loading_time);
-        break;
+      if (delegate_) {
+        delegate_->OnAbortedFrameLoad(loader->request()->url(),
+                                      request_loading_time);
+      }
     }
 
     if (loader->request()->url().SchemeIsCryptographic()) {
@@ -1166,12 +1113,9 @@
 
   // Parse the headers before calling ShouldServiceRequest, so that they are
   // available to be validated.
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(request_data.headers);
-
   if (is_shutdown_ ||
-      !ShouldServiceRequest(child_id, request_data, headers, requester_info,
-                            resource_context)) {
+      !ShouldServiceRequest(child_id, request_data, request_data.headers,
+                            requester_info, resource_context)) {
     AbortRequestBeforeItStarts(requester_info->filter(), sync_result_handler,
                                request_id, std::move(url_loader_client));
     return;
@@ -1204,7 +1148,8 @@
     // yes then we need to mark the current request as pending and wait for the
     // interceptor to invoke the callback with a status code indicating whether
     // the request needs to be aborted or continued.
-    for (net::HttpRequestHeaders::Iterator it(headers); it.GetNext();) {
+    for (net::HttpRequestHeaders::Iterator it(request_data.headers);
+         it.GetNext();) {
       HeaderInterceptorMap::iterator index =
           http_header_interceptor_map_.find(it.name());
       if (index != http_header_interceptor_map_.end()) {
@@ -1223,7 +1168,8 @@
                   &ResourceDispatcherHostImpl::ContinuePendingBeginRequest,
                   base::Unretained(this), make_scoped_refptr(requester_info),
                   request_id, request_data, is_sync_load, sync_result_handler,
-                  route_id, headers, base::Passed(std::move(mojo_request)),
+                  route_id, request_data.headers,
+                  base::Passed(std::move(mojo_request)),
                   base::Passed(std::move(url_loader_client)),
                   base::Passed(std::move(blob_handles)), traffic_annotation));
           return;
@@ -1231,11 +1177,12 @@
       }
     }
   }
-  ContinuePendingBeginRequest(
-      requester_info, request_id, request_data, is_sync_load,
-      sync_result_handler, route_id, headers, std::move(mojo_request),
-      std::move(url_loader_client), std::move(blob_handles), traffic_annotation,
-      HeaderInterceptorResult::CONTINUE);
+  ContinuePendingBeginRequest(requester_info, request_id, request_data,
+                              is_sync_load, sync_result_handler, route_id,
+                              request_data.headers, std::move(mojo_request),
+                              std::move(url_loader_client),
+                              std::move(blob_handles), traffic_annotation,
+                              HeaderInterceptorResult::CONTINUE);
 }
 
 void ResourceDispatcherHostImpl::ContinuePendingBeginRequest(

diff --git a/content/browser/net/reporting_service_proxy.cc b/content/browser/net/reporting_service_proxy.cc
index b343e1f..10f302c 100644
--- a/content/browser/net/reporting_service_proxy.cc
+++ b/content/browser/net/reporting_service_proxy.cc

@@ -36,9 +36,6 @@
                    const std::string& group,
                    const std::string& type,
                    std::unique_ptr<base::Value> body) override {
-    std::unique_ptr<const base::Value> const_body =
-        base::WrapUnique(body.release());
-
     net::URLRequestContext* request_context =
         request_context_getter_->GetURLRequestContext();
     if (!request_context) {
@@ -53,7 +50,7 @@
       return;
     }
 
-    reporting_service->QueueReport(url, group, type, std::move(const_body));
+    reporting_service->QueueReport(url, group, type, std::move(body));
   }
 
  private:

diff --git a/content/browser/renderer_host/database_message_filter.cc b/content/browser/renderer_host/database_message_filter.cc
index 193db77a7..63716a0 100644
--- a/content/browser/renderer_host/database_message_filter.cc
+++ b/content/browser/renderer_host/database_message_filter.cc

@@ -16,6 +16,8 @@
 #include "build/build_config.h"
 #include "content/browser/bad_message.h"
 #include "content/common/database_messages.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/common/bind_interface_helpers.h"
 #include "content/public/common/origin_util.h"
 #include "content/public/common/result_codes.h"
 #include "storage/browser/database/database_util.h"
@@ -49,20 +51,19 @@
 }  // namespace
 
 DatabaseMessageFilter::DatabaseMessageFilter(
+    int process_id,
     storage::DatabaseTracker* db_tracker)
     : BrowserMessageFilter(DatabaseMsgStart),
+      process_id_(process_id),
       db_tracker_(db_tracker),
       observer_added_(false) {
   DCHECK(db_tracker_.get());
 }
 
 void DatabaseMessageFilter::OnChannelClosing() {
-  if (observer_added_) {
-    observer_added_ = false;
-    db_tracker_->task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&DatabaseMessageFilter::RemoveObserver, this));
-  }
+  db_tracker_->task_runner()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&DatabaseMessageFilter::CloseOnDatabaseTrackerTask, this));
 }
 
 void DatabaseMessageFilter::AddObserver() {
@@ -82,12 +83,6 @@
 
 base::TaskRunner* DatabaseMessageFilter::OverrideTaskRunnerForMessage(
     const IPC::Message& message) {
-  if (message.type() == DatabaseHostMsg_Opened::ID && !observer_added_) {
-    observer_added_ = true;
-    db_tracker_->task_runner()->PostTask(
-        FROM_HERE, base::BindOnce(&DatabaseMessageFilter::AddObserver, this));
-  }
-
   // GetSpaceAvailable talks to the quota manager on IO thread, so avoid
   // multiple hops.
   if (message.type() == DatabaseHostMsg_GetSpaceAvailable::ID)
@@ -323,6 +318,11 @@
     int64_t estimated_size) {
   DCHECK(db_tracker_->task_runner()->RunsTasksInCurrentSequence());
 
+  if (!observer_added_) {
+    observer_added_ = true;
+    AddObserver();
+  }
+
   if (!IsOriginValid(origin)) {
     bad_message::ReceivedBadMessage(this,
                                     bad_message::DBMF_INVALID_ORIGIN_ON_OPEN);
@@ -338,7 +338,8 @@
                               estimated_size, &database_size);
 
   database_connections_.AddConnection(origin_identifier, database_name);
-  Send(new DatabaseMsg_UpdateSize(origin, database_name, database_size));
+
+  GetWebDatabase().UpdateSize(origin, database_name, database_size);
 }
 
 void DatabaseMessageFilter::OnDatabaseModified(
@@ -407,20 +408,51 @@
     const base::string16& database_name,
     int64_t database_size) {
   DCHECK(db_tracker_->task_runner()->RunsTasksInCurrentSequence());
-  if (database_connections_.IsOriginUsed(origin_identifier)) {
-    Send(new DatabaseMsg_UpdateSize(
-        url::Origin(storage::GetOriginFromIdentifier(origin_identifier)),
-        database_name, database_size));
+  if (!database_connections_.IsOriginUsed(origin_identifier)) {
+    return;
   }
+
+  GetWebDatabase().UpdateSize(
+      url::Origin(storage::GetOriginFromIdentifier(origin_identifier)),
+      database_name, database_size);
 }
 
 void DatabaseMessageFilter::OnDatabaseScheduledForDeletion(
     const std::string& origin_identifier,
     const base::string16& database_name) {
   DCHECK(db_tracker_->task_runner()->RunsTasksInCurrentSequence());
-  Send(new DatabaseMsg_CloseImmediately(
+
+  GetWebDatabase().CloseImmediately(
       url::Origin(storage::GetOriginFromIdentifier(origin_identifier)),
-      database_name));
+      database_name);
+}
+
+void DatabaseMessageFilter::CloseOnDatabaseTrackerTask() {
+  DCHECK(db_tracker_->task_runner()->RunsTasksInCurrentSequence());
+  if (observer_added_) {
+    observer_added_ = false;
+    RemoveObserver();
+  }
+  database_provider_.reset();
+}
+
+content::mojom::WebDatabase& DatabaseMessageFilter::GetWebDatabase() {
+  DCHECK(db_tracker_->task_runner()->RunsTasksInCurrentSequence());
+  if (!database_provider_) {
+    // The interface binding needs to occur on the UI thread, as we can
+    // only call RenderProcessHost::FromID() on the UI thread.
+    BrowserThread::PostTask(
+        BrowserThread::UI, FROM_HERE,
+        base::BindOnce(
+            [](int process_id, content::mojom::WebDatabaseRequest request) {
+              RenderProcessHost* host = RenderProcessHost::FromID(process_id);
+              if (host) {
+                content::BindInterface(host, std::move(request));
+              }
+            },
+            process_id_, mojo::MakeRequest(&database_provider_)));
+  }
+  return *database_provider_;
 }
 
 }  // namespace content

diff --git a/content/browser/renderer_host/database_message_filter.h b/content/browser/renderer_host/database_message_filter.h
index 4f40209..6c6907b 100644
--- a/content/browser/renderer_host/database_message_filter.h
+++ b/content/browser/renderer_host/database_message_filter.h

@@ -9,6 +9,7 @@
 
 #include "base/containers/hash_tables.h"
 #include "base/strings/string16.h"
+#include "content/common/web_database.mojom.h"
 #include "content/public/browser/browser_message_filter.h"
 #include "ipc/ipc_platform_file.h"
 #include "storage/browser/database/database_tracker.h"
@@ -24,7 +25,8 @@
 class DatabaseMessageFilter : public BrowserMessageFilter,
                               public storage::DatabaseTracker::Observer {
  public:
-  explicit DatabaseMessageFilter(storage::DatabaseTracker* db_tracker);
+  explicit DatabaseMessageFilter(int process_id,
+                                 storage::DatabaseTracker* db_tracker);
 
   // BrowserMessageFilter implementation.
   void OnChannelClosing() override;
@@ -93,6 +95,18 @@
                           IPC::Message* reply_msg,
                           int reschedule_count);
 
+  // Callback used to close the connection to the WebDatabase mojo interface on
+  // the db_tracker task runner.
+  void CloseOnDatabaseTrackerTask();
+
+  // Helper function to get the mojo interface for the WebDatabase on the
+  // render process. Creates the WebDatabase connection if it does not already
+  // exist.
+  content::mojom::WebDatabase& GetWebDatabase();
+
+  // Our render process host ID, used to bind to the correct render process.
+  const int process_id_;
+
   // The database tracker for the current browser context.
   scoped_refptr<storage::DatabaseTracker> db_tracker_;
 
@@ -102,6 +116,9 @@
 
   // Keeps track of all DB connections opened by this renderer
   storage::DatabaseConnections database_connections_;
+
+  // Interface to the render process WebDatabase.
+  content::mojom::WebDatabasePtr database_provider_;
 };
 
 }  // namespace content

diff --git a/content/browser/renderer_host/delegated_frame_host.cc b/content/browser/renderer_host/delegated_frame_host.cc
index b2a26b3..b44340c 100644
--- a/content/browser/renderer_host/delegated_frame_host.cc
+++ b/content/browser/renderer_host/delegated_frame_host.cc

@@ -375,10 +375,10 @@
 
 void DelegatedFrameHost::DidCreateNewRendererCompositorFrameSink(
     viz::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink) {
+  EvictDelegatedFrame();
   ResetCompositorFrameSinkSupport();
   renderer_compositor_frame_sink_ = renderer_compositor_frame_sink;
   CreateCompositorFrameSinkSupport();
-  has_frame_ = false;
 }
 
 void DelegatedFrameHost::SubmitCompositorFrame(

diff --git a/content/browser/renderer_host/input/input_router_impl.cc b/content/browser/renderer_host/input/input_router_impl.cc
index 0b60ae4..7c51daa 100644
--- a/content/browser/renderer_host/input/input_router_impl.cc
+++ b/content/browser/renderer_host/input/input_router_impl.cc

@@ -156,28 +156,6 @@
                              std::move(callback));
 }
 
-void InputRouterImpl::KeyboardEventHandled(
-    const NativeWebKeyboardEventWithLatencyInfo& event,
-    InputEventAckSource source,
-    const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
-  TRACE_EVENT2("input", "InputRouterImpl::KeboardEventHandled", "type",
-               WebInputEvent::GetName(event.event.GetType()), "ack",
-               GetEventAckName(state));
-
-  if (source != InputEventAckSource::BROWSER)
-    client_->DecrementInFlightEventCount(source);
-  event.latency.AddNewLatencyFrom(latency);
-  disposition_handler_->OnKeyboardEventAck(event, state);
-
-  // WARNING: This InputRouterImpl can be deallocated at this point
-  // (i.e.  in the case of Ctrl+W, where the call to
-  // HandleKeyboardEvent destroys this InputRouterImpl).
-  // TODO(jdduke): crbug.com/274029 - Make ack-triggered shutdown async.
-}
-
 void InputRouterImpl::SendGestureEvent(
     const GestureEventWithLatencyInfo& original_gesture_event) {
   input_stream_validator_.Validate(original_gesture_event.event);
@@ -218,6 +196,76 @@
   touch_event_queue_->QueueEvent(updatd_touch_event);
 }
 
+void InputRouterImpl::NotifySiteIsMobileOptimized(bool is_mobile_optimized) {
+  touch_event_queue_->SetIsMobileOptimizedSite(is_mobile_optimized);
+}
+
+bool InputRouterImpl::HasPendingEvents() const {
+  return !touch_event_queue_->Empty() || !gesture_event_queue_.empty() ||
+         wheel_event_queue_.has_pending() || active_renderer_fling_count_ > 0;
+}
+
+void InputRouterImpl::SetDeviceScaleFactor(float device_scale_factor) {
+  device_scale_factor_ = device_scale_factor;
+}
+
+void InputRouterImpl::SetFrameTreeNodeId(int frame_tree_node_id) {
+  frame_tree_node_id_ = frame_tree_node_id;
+}
+
+void InputRouterImpl::SetForceEnableZoom(bool enabled) {
+  touch_action_filter_.SetForceEnableZoom(enabled);
+}
+
+cc::TouchAction InputRouterImpl::AllowedTouchAction() {
+  return touch_action_filter_.allowed_touch_action();
+}
+
+bool InputRouterImpl::OnMessageReceived(const IPC::Message& message) {
+  // TODO(dtapuska): Move these to mojo
+  bool handled = true;
+  IPC_BEGIN_MESSAGE_MAP(InputRouterImpl, message)
+    IPC_MESSAGE_HANDLER(InputHostMsg_DidOverscroll, OnDidOverscroll)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_HasTouchEventHandlers,
+                        OnHasTouchEventHandlers)
+    IPC_MESSAGE_HANDLER(InputHostMsg_SetTouchAction, OnSetTouchAction)
+    IPC_MESSAGE_HANDLER(InputHostMsg_SetWhiteListedTouchAction,
+                        OnSetWhiteListedTouchAction)
+    IPC_MESSAGE_HANDLER(InputHostMsg_DidStopFlinging, OnDidStopFlinging)
+    IPC_MESSAGE_UNHANDLED(handled = false)
+  IPC_END_MESSAGE_MAP()
+
+  return handled;
+}
+
+void InputRouterImpl::SetMovementXYForTouchPoints(blink::WebTouchEvent* event) {
+  for (size_t i = 0; i < event->touches_length; ++i) {
+    blink::WebTouchPoint* touch_point = &event->touches[i];
+    if (touch_point->state == blink::WebTouchPoint::kStateMoved) {
+      const gfx::Point& last_position = global_touch_position_[touch_point->id];
+      touch_point->movement_x =
+          touch_point->PositionInScreen().x - last_position.x();
+      touch_point->movement_y =
+          touch_point->PositionInScreen().y - last_position.y();
+      global_touch_position_[touch_point->id].SetPoint(
+          touch_point->PositionInScreen().x, touch_point->PositionInScreen().y);
+    } else {
+      touch_point->movement_x = 0;
+      touch_point->movement_y = 0;
+      if (touch_point->state == blink::WebTouchPoint::kStateReleased ||
+          touch_point->state == blink::WebTouchPoint::kStateCancelled) {
+        global_touch_position_.erase(touch_point->id);
+      } else if (touch_point->state == blink::WebTouchPoint::kStatePressed) {
+        DCHECK(global_touch_position_.find(touch_point->id) ==
+               global_touch_position_.end());
+        global_touch_position_[touch_point->id] =
+            gfx::Point(touch_point->PositionInScreen().x,
+                       touch_point->PositionInScreen().y);
+      }
+    }
+  }
+}
+
 // Forwards MouseEvent without passing it through
 // TouchpadTapSuppressionController.
 void InputRouterImpl::SendMouseEventImmediately(
@@ -228,23 +276,6 @@
                              std::move(callback));
 }
 
-void InputRouterImpl::MouseEventHandled(
-    const MouseEventWithLatencyInfo& event,
-    InputEventAckSource source,
-    const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
-  TRACE_EVENT2("input", "InputRouterImpl::MouseEventHandled", "type",
-               WebInputEvent::GetName(event.event.GetType()), "ack",
-               GetEventAckName(state));
-
-  if (source != InputEventAckSource::BROWSER)
-    client_->DecrementInFlightEventCount(source);
-  event.latency.AddNewLatencyFrom(latency);
-  disposition_handler_->OnMouseEventAck(event, state);
-}
-
 void InputRouterImpl::SendTouchEventImmediately(
     const TouchEventWithLatencyInfo& touch_event) {
   mojom::WidgetInputHandler::DispatchEventCallback callback = base::BindOnce(
@@ -253,31 +284,6 @@
                              std::move(callback));
 }
 
-void InputRouterImpl::TouchEventHandled(
-    const TouchEventWithLatencyInfo& touch_event,
-    InputEventAckSource source,
-    const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
-  TRACE_EVENT2("input", "InputRouterImpl::TouchEventHandled", "type",
-               WebInputEvent::GetName(touch_event.event.GetType()), "ack",
-               GetEventAckName(state));
-  if (source != InputEventAckSource::BROWSER)
-    client_->DecrementInFlightEventCount(source);
-  touch_event.latency.AddNewLatencyFrom(latency);
-
-  // The SetTouchAction IPC occurs on a different channel so always
-  // send it in the input event ack to ensure it is available at the
-  // time the ACK is handled.
-  if (touch_action.has_value())
-    OnSetTouchAction(touch_action.value());
-
-  // |touch_event_queue_| will forward to OnTouchEventAck when appropriate.
-  touch_event_queue_->ProcessTouchAck(state, latency,
-                                      touch_event.event.unique_touch_event_id);
-}
-
 void InputRouterImpl::OnTouchEventAck(const TouchEventWithLatencyInfo& event,
                                       InputEventAckState ack_result) {
   // Touchstart events sent to the renderer indicate a new touch sequence, but
@@ -296,73 +302,6 @@
   }
 }
 
-void InputRouterImpl::SendGestureEventImmediately(
-    const GestureEventWithLatencyInfo& gesture_event) {
-  mojom::WidgetInputHandler::DispatchEventCallback callback = base::BindOnce(
-      &InputRouterImpl::GestureEventHandled, weak_this_, gesture_event);
-  FilterAndSendWebInputEvent(gesture_event.event, gesture_event.latency,
-                             std::move(callback));
-}
-
-void InputRouterImpl::GestureEventHandled(
-    const GestureEventWithLatencyInfo& gesture_event,
-    InputEventAckSource source,
-    const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
-  TRACE_EVENT2("input", "InputRouterImpl::GestureEventHandled", "type",
-               WebInputEvent::GetName(gesture_event.event.GetType()), "ack",
-               GetEventAckName(state));
-  if (source != InputEventAckSource::BROWSER)
-    client_->DecrementInFlightEventCount(source);
-  if (gesture_event.event.GetType() ==
-          blink::WebInputEvent::kGestureFlingStart &&
-      state == INPUT_EVENT_ACK_STATE_CONSUMED) {
-    ++active_renderer_fling_count_;
-  }
-
-  if (overscroll) {
-    DCHECK_EQ(WebInputEvent::kGestureScrollUpdate,
-              gesture_event.event.GetType());
-    OnDidOverscroll(overscroll.value());
-  }
-
-  // |gesture_event_queue_| will forward to OnGestureEventAck when appropriate.
-  gesture_event_queue_.ProcessGestureAck(state, gesture_event.event.GetType(),
-                                         latency);
-}
-
-void InputRouterImpl::NotifySiteIsMobileOptimized(bool is_mobile_optimized) {
-  touch_event_queue_->SetIsMobileOptimizedSite(is_mobile_optimized);
-}
-
-bool InputRouterImpl::HasPendingEvents() const {
-  return !touch_event_queue_->Empty() || !gesture_event_queue_.empty() ||
-         wheel_event_queue_.has_pending() || active_renderer_fling_count_ > 0;
-}
-
-void InputRouterImpl::SetDeviceScaleFactor(float device_scale_factor) {
-  device_scale_factor_ = device_scale_factor;
-}
-
-bool InputRouterImpl::OnMessageReceived(const IPC::Message& message) {
-  // TODO(dtapuska): Move these to mojo
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(InputRouterImpl, message)
-    IPC_MESSAGE_HANDLER(InputHostMsg_DidOverscroll, OnDidOverscroll)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_HasTouchEventHandlers,
-                        OnHasTouchEventHandlers)
-    IPC_MESSAGE_HANDLER(InputHostMsg_SetTouchAction, OnSetTouchAction)
-    IPC_MESSAGE_HANDLER(InputHostMsg_SetWhiteListedTouchAction,
-                        OnSetWhiteListedTouchAction)
-    IPC_MESSAGE_HANDLER(InputHostMsg_DidStopFlinging, OnDidStopFlinging)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-
-  return handled;
-}
-
 void InputRouterImpl::OnFilteringTouchEvent(const WebTouchEvent& touch_event) {
   // The event stream given to the renderer is not guaranteed to be
   // valid based on the current TouchEventStreamValidator rules. This event will
@@ -374,6 +313,14 @@
   output_stream_validator_.Validate(touch_event);
 }
 
+void InputRouterImpl::SendGestureEventImmediately(
+    const GestureEventWithLatencyInfo& gesture_event) {
+  mojom::WidgetInputHandler::DispatchEventCallback callback = base::BindOnce(
+      &InputRouterImpl::GestureEventHandled, weak_this_, gesture_event);
+  FilterAndSendWebInputEvent(gesture_event.event, gesture_event.latency,
+                             std::move(callback));
+}
+
 void InputRouterImpl::OnGestureEventAck(
     const GestureEventWithLatencyInfo& event,
     InputEventAckState ack_result) {
@@ -381,12 +328,6 @@
   disposition_handler_->OnGestureEventAck(event, ack_result);
 }
 
-void InputRouterImpl::ForwardGestureEventWithLatencyInfo(
-    const blink::WebGestureEvent& event,
-    const ui::LatencyInfo& latency_info) {
-  client_->ForwardGestureEventWithLatencyInfo(event, latency_info);
-}
-
 void InputRouterImpl::SendMouseWheelEventImmediately(
     const MouseWheelEventWithLatencyInfo& wheel_event) {
   mojom::WidgetInputHandler::DispatchEventCallback callback = base::BindOnce(
@@ -395,32 +336,18 @@
                              std::move(callback));
 }
 
-void InputRouterImpl::MouseWheelEventHandled(
-    const MouseWheelEventWithLatencyInfo& event,
-    InputEventAckSource source,
-    const ui::LatencyInfo& latency,
-    InputEventAckState state,
-    const base::Optional<ui::DidOverscrollParams>& overscroll,
-    const base::Optional<cc::TouchAction>& touch_action) {
-  TRACE_EVENT2("input", "InputRouterImpl::MouseWheelEventHandled", "type",
-               WebInputEvent::GetName(event.event.GetType()), "ack",
-               GetEventAckName(state));
-  if (source != InputEventAckSource::BROWSER)
-    client_->DecrementInFlightEventCount(source);
-  event.latency.AddNewLatencyFrom(latency);
-
-  if (overscroll)
-    OnDidOverscroll(overscroll.value());
-
-  wheel_event_queue_.ProcessMouseWheelAck(state, event.latency);
-}
-
 void InputRouterImpl::OnMouseWheelEventAck(
     const MouseWheelEventWithLatencyInfo& event,
     InputEventAckState ack_result) {
   disposition_handler_->OnWheelEventAck(event, ack_result);
 }
 
+void InputRouterImpl::ForwardGestureEventWithLatencyInfo(
+    const blink::WebGestureEvent& event,
+    const ui::LatencyInfo& latency_info) {
+  client_->ForwardGestureEventWithLatencyInfo(event, latency_info);
+}
+
 void InputRouterImpl::FilterAndSendWebInputEvent(
     const WebInputEvent& input_event,
     const ui::LatencyInfo& latency_info,
@@ -461,6 +388,119 @@
   }
 }
 
+void InputRouterImpl::KeyboardEventHandled(
+    const NativeWebKeyboardEventWithLatencyInfo& event,
+    InputEventAckSource source,
+    const ui::LatencyInfo& latency,
+    InputEventAckState state,
+    const base::Optional<ui::DidOverscrollParams>& overscroll,
+    const base::Optional<cc::TouchAction>& touch_action) {
+  TRACE_EVENT2("input", "InputRouterImpl::KeboardEventHandled", "type",
+               WebInputEvent::GetName(event.event.GetType()), "ack",
+               GetEventAckName(state));
+
+  if (source != InputEventAckSource::BROWSER)
+    client_->DecrementInFlightEventCount(source);
+  event.latency.AddNewLatencyFrom(latency);
+  disposition_handler_->OnKeyboardEventAck(event, state);
+
+  // WARNING: This InputRouterImpl can be deallocated at this point
+  // (i.e.  in the case of Ctrl+W, where the call to
+  // HandleKeyboardEvent destroys this InputRouterImpl).
+  // TODO(jdduke): crbug.com/274029 - Make ack-triggered shutdown async.
+}
+
+void InputRouterImpl::MouseEventHandled(
+    const MouseEventWithLatencyInfo& event,
+    InputEventAckSource source,
+    const ui::LatencyInfo& latency,
+    InputEventAckState state,
+    const base::Optional<ui::DidOverscrollParams>& overscroll,
+    const base::Optional<cc::TouchAction>& touch_action) {
+  TRACE_EVENT2("input", "InputRouterImpl::MouseEventHandled", "type",
+               WebInputEvent::GetName(event.event.GetType()), "ack",
+               GetEventAckName(state));
+
+  if (source != InputEventAckSource::BROWSER)
+    client_->DecrementInFlightEventCount(source);
+  event.latency.AddNewLatencyFrom(latency);
+  disposition_handler_->OnMouseEventAck(event, state);
+}
+
+void InputRouterImpl::TouchEventHandled(
+    const TouchEventWithLatencyInfo& touch_event,
+    InputEventAckSource source,
+    const ui::LatencyInfo& latency,
+    InputEventAckState state,
+    const base::Optional<ui::DidOverscrollParams>& overscroll,
+    const base::Optional<cc::TouchAction>& touch_action) {
+  TRACE_EVENT2("input", "InputRouterImpl::TouchEventHandled", "type",
+               WebInputEvent::GetName(touch_event.event.GetType()), "ack",
+               GetEventAckName(state));
+  if (source != InputEventAckSource::BROWSER)
+    client_->DecrementInFlightEventCount(source);
+  touch_event.latency.AddNewLatencyFrom(latency);
+
+  // The SetTouchAction IPC occurs on a different channel so always
+  // send it in the input event ack to ensure it is available at the
+  // time the ACK is handled.
+  if (touch_action.has_value())
+    OnSetTouchAction(touch_action.value());
+
+  // |touch_event_queue_| will forward to OnTouchEventAck when appropriate.
+  touch_event_queue_->ProcessTouchAck(state, latency,
+                                      touch_event.event.unique_touch_event_id);
+}
+
+void InputRouterImpl::GestureEventHandled(
+    const GestureEventWithLatencyInfo& gesture_event,
+    InputEventAckSource source,
+    const ui::LatencyInfo& latency,
+    InputEventAckState state,
+    const base::Optional<ui::DidOverscrollParams>& overscroll,
+    const base::Optional<cc::TouchAction>& touch_action) {
+  TRACE_EVENT2("input", "InputRouterImpl::GestureEventHandled", "type",
+               WebInputEvent::GetName(gesture_event.event.GetType()), "ack",
+               GetEventAckName(state));
+  if (source != InputEventAckSource::BROWSER)
+    client_->DecrementInFlightEventCount(source);
+  if (gesture_event.event.GetType() ==
+          blink::WebInputEvent::kGestureFlingStart &&
+      state == INPUT_EVENT_ACK_STATE_CONSUMED) {
+    ++active_renderer_fling_count_;
+  }
+
+  if (overscroll) {
+    DCHECK_EQ(WebInputEvent::kGestureScrollUpdate,
+              gesture_event.event.GetType());
+    OnDidOverscroll(overscroll.value());
+  }
+
+  // |gesture_event_queue_| will forward to OnGestureEventAck when appropriate.
+  gesture_event_queue_.ProcessGestureAck(state, gesture_event.event.GetType(),
+                                         latency);
+}
+
+void InputRouterImpl::MouseWheelEventHandled(
+    const MouseWheelEventWithLatencyInfo& event,
+    InputEventAckSource source,
+    const ui::LatencyInfo& latency,
+    InputEventAckState state,
+    const base::Optional<ui::DidOverscrollParams>& overscroll,
+    const base::Optional<cc::TouchAction>& touch_action) {
+  TRACE_EVENT2("input", "InputRouterImpl::MouseWheelEventHandled", "type",
+               WebInputEvent::GetName(event.event.GetType()), "ack",
+               GetEventAckName(state));
+  if (source != InputEventAckSource::BROWSER)
+    client_->DecrementInFlightEventCount(source);
+  event.latency.AddNewLatencyFrom(latency);
+
+  if (overscroll)
+    OnDidOverscroll(overscroll.value());
+
+  wheel_event_queue_.ProcessMouseWheelAck(state, event.latency);
+}
+
 void InputRouterImpl::OnDidOverscroll(const ui::DidOverscrollParams& params) {
   client_->DidOverscroll(params);
 }
@@ -521,44 +561,6 @@
   touch_event_queue_->SetAckTimeoutEnabled(touch_ack_timeout_enabled);
 }
 
-void InputRouterImpl::SetFrameTreeNodeId(int frame_tree_node_id) {
-  frame_tree_node_id_ = frame_tree_node_id;
-}
 
-cc::TouchAction InputRouterImpl::AllowedTouchAction() {
-  return touch_action_filter_.allowed_touch_action();
-}
-
-void InputRouterImpl::SetForceEnableZoom(bool enabled) {
-  touch_action_filter_.SetForceEnableZoom(enabled);
-}
-
-void InputRouterImpl::SetMovementXYForTouchPoints(blink::WebTouchEvent* event) {
-  for (size_t i = 0; i < event->touches_length; ++i) {
-    blink::WebTouchPoint* touch_point = &event->touches[i];
-    if (touch_point->state == blink::WebTouchPoint::kStateMoved) {
-      const gfx::Point& last_position = global_touch_position_[touch_point->id];
-      touch_point->movement_x =
-          touch_point->PositionInScreen().x - last_position.x();
-      touch_point->movement_y =
-          touch_point->PositionInScreen().y - last_position.y();
-      global_touch_position_[touch_point->id].SetPoint(
-          touch_point->PositionInScreen().x, touch_point->PositionInScreen().y);
-    } else {
-      touch_point->movement_x = 0;
-      touch_point->movement_y = 0;
-      if (touch_point->state == blink::WebTouchPoint::kStateReleased ||
-          touch_point->state == blink::WebTouchPoint::kStateCancelled) {
-        global_touch_position_.erase(touch_point->id);
-      } else if (touch_point->state == blink::WebTouchPoint::kStatePressed) {
-        DCHECK(global_touch_position_.find(touch_point->id) ==
-               global_touch_position_.end());
-        global_touch_position_[touch_point->id] =
-            gfx::Point(touch_point->PositionInScreen().x,
-                       touch_point->PositionInScreen().y);
-      }
-    }
-  }
-}
 
 }  // namespace content

diff --git a/content/browser/renderer_host/input/input_router_impl.h b/content/browser/renderer_host/input/input_router_impl.h
index 2748e0b..f9c987f 100644
--- a/content/browser/renderer_host/input/input_router_impl.h
+++ b/content/browser/renderer_host/input/input_router_impl.h

@@ -66,16 +66,13 @@
   void NotifySiteIsMobileOptimized(bool is_mobile_optimized) override;
   bool HasPendingEvents() const override;
   void SetDeviceScaleFactor(float device_scale_factor) override;
+  void SetFrameTreeNodeId(int frame_tree_node_id) override;
+  void SetForceEnableZoom(bool enabled) override;
+  cc::TouchAction AllowedTouchAction() override;
 
   // IPC::Listener
   bool OnMessageReceived(const IPC::Message& message) override;
 
-  void SetFrameTreeNodeId(int frame_tree_node_id) override;
-
-  void SetForceEnableZoom(bool enabled) override;
-
-  cc::TouchAction AllowedTouchAction() override;
-
  private:
   friend class InputRouterImplTest;
 
@@ -108,10 +105,6 @@
       const blink::WebGestureEvent& gesture_event,
       const ui::LatencyInfo& latency_info) override;
 
-  bool SendMoveCaret(std::unique_ptr<IPC::Message> message);
-  bool SendSelectMessage(std::unique_ptr<IPC::Message> message);
-  bool Send(IPC::Message* message);
-
   void FilterAndSendWebInputEvent(
       const blink::WebInputEvent& input_event,
       const ui::LatencyInfo& latency_info,
@@ -162,33 +155,6 @@
                                    InputEventAckState ack_result);
   void OnDidStopFlinging();
 
-  // Dispatches the ack'ed event to |ack_handler_|.
-  void ProcessKeyboardAck(blink::WebInputEvent::Type type,
-                          InputEventAckState ack_result,
-                          const ui::LatencyInfo& latency);
-
-  // Forwards a valid |next_mouse_move_| if |type| is MouseMove.
-  void ProcessMouseAck(blink::WebInputEvent::Type type,
-                       InputEventAckState ack_result,
-                       const ui::LatencyInfo& latency);
-
-  // Dispatches the ack'ed event to |ack_handler_|, forwarding queued events
-  // from |coalesced_mouse_wheel_events_|.
-  void ProcessWheelAck(InputEventAckState ack_result,
-                       const ui::LatencyInfo& latency);
-
-  // Forwards the event ack to |gesture_event_queue|, potentially triggering
-  // dispatch of queued gesture events.
-  void ProcessGestureAck(blink::WebInputEvent::Type type,
-                         InputEventAckState ack_result,
-                         const ui::LatencyInfo& latency);
-
-  // Forwards the event ack to |touch_event_queue_|, potentially triggering
-  // dispatch of queued touch events, or the creation of gesture events.
-  void ProcessTouchAck(InputEventAckState ack_result,
-                       const ui::LatencyInfo& latency,
-                       uint32_t unique_touch_event_id);
-
   // Called when a touch timeout-affecting bit has changed, in turn toggling the
   // touch ack timeout feature of the |touch_event_queue_| as appropriate. Input
   // to that determination includes current view properties and the allowed

diff --git a/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc b/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc
index 8d1cd81..1a213a8 100644
--- a/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc
+++ b/content/browser/renderer_host/input/touch_selection_controller_client_aura.cc

@@ -191,6 +191,10 @@
   return false;
 }
 
+void TouchSelectionControllerClientAura::DidStopFlinging() {
+  OnScrollCompleted();
+}
+
 void TouchSelectionControllerClientAura::UpdateClientSelectionBounds(
     const gfx::SelectionBound& start,
     const gfx::SelectionBound& end) {

diff --git a/content/browser/renderer_host/input/touch_selection_controller_client_aura.h b/content/browser/renderer_host/input/touch_selection_controller_client_aura.h
index 69b1111..700ed1c1 100644
--- a/content/browser/renderer_host/input/touch_selection_controller_client_aura.h
+++ b/content/browser/renderer_host/input/touch_selection_controller_client_aura.h

@@ -55,6 +55,7 @@
                                    const gfx::SelectionBound& end);
 
   // TouchSelectionControllerClientManager.
+  void DidStopFlinging() override;
   void UpdateClientSelectionBounds(
       const gfx::SelectionBound& start,
       const gfx::SelectionBound& end,

diff --git a/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc b/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc
index af448629..884a3c0 100644
--- a/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc
+++ b/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.cc

@@ -31,6 +31,10 @@
   manager_->InvalidateClient(this);
 }
 
+void TouchSelectionControllerClientChildFrame::DidStopFlinging() {
+  manager_->DidStopFlinging();
+}
+
 void TouchSelectionControllerClientChildFrame::UpdateSelectionBoundsIfNeeded(
     const cc::Selection<gfx::SelectionBound>& selection,
     float device_scale_factor) {

diff --git a/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.h b/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.h
index 4f8137e..9a9af966 100644
--- a/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.h
+++ b/content/browser/renderer_host/input/touch_selection_controller_client_child_frame.h

@@ -31,6 +31,7 @@
       TouchSelectionControllerClientManager* manager);
   ~TouchSelectionControllerClientChildFrame() override;
 
+  void DidStopFlinging();
   void UpdateSelectionBoundsIfNeeded(
       const cc::Selection<gfx::SelectionBound>& selection,
       float device_scale_factor);

diff --git a/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.cc b/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.cc
index c2b3251..de89ada 100644
--- a/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.cc
+++ b/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.cc

@@ -43,6 +43,10 @@
 }  // namespace
 
 // TouchSelectionControllerClientManager implementation.
+void TouchSelectionControllerClientManagerAndroid::DidStopFlinging() {
+  // TODO(wjmaclean): determine what, if anything, needs to happen here.
+}
+
 void TouchSelectionControllerClientManagerAndroid::UpdateClientSelectionBounds(
     const gfx::SelectionBound& start,
     const gfx::SelectionBound& end,

diff --git a/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.h b/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.h
index ff406582..27349a8 100644
--- a/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.h
+++ b/content/browser/renderer_host/input/touch_selection_controller_client_manager_android.h

@@ -25,6 +25,7 @@
   float page_scale_factor() { return page_scale_factor_; }
 
   // TouchSelectionControllerClientManager implementation.
+  void DidStopFlinging() override;
   void UpdateClientSelectionBounds(
       const gfx::SelectionBound& start,
       const gfx::SelectionBound& end,

diff --git a/content/browser/renderer_host/media/audio_input_renderer_host.cc b/content/browser/renderer_host/media/audio_input_renderer_host.cc
index a75809a..03e99ad 100644
--- a/content/browser/renderer_host/media/audio_input_renderer_host.cc
+++ b/content/browser/renderer_host/media/audio_input_renderer_host.cc

@@ -225,8 +225,7 @@
 
   Send(new AudioInputMsg_NotifyStreamCreated(
       entry->stream_id, foreign_memory_handle, socket_transit_descriptor,
-      writer->shared_memory()->requested_size(),
-      writer->shared_memory_segment_count(), initially_muted));
+      initially_muted));
 
   // Free the foreign socket on here since it isn't needed anymore in this
   // process.

diff --git a/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc b/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc
index f6bc81f..af879d9 100644
--- a/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc
+++ b/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc

@@ -77,12 +77,10 @@
 
 class MockRenderer {
  public:
-  MOCK_METHOD6(NotifyStreamCreated,
+  MOCK_METHOD4(NotifyStreamCreated,
                void(int /*stream_id*/,
                     base::SharedMemoryHandle /*handle*/,
                     base::SyncSocket::TransitDescriptor /*socket_desriptor*/,
-                    uint32_t /*length*/,
-                    uint32_t /*total_segments*/,
                     bool initially_muted));
   MOCK_METHOD1(NotifyStreamError, void(int /*stream_id*/));
   MOCK_METHOD0(WasShutDown, void());
@@ -137,17 +135,16 @@
       int stream_id,
       base::SharedMemoryHandle handle,
       base::SyncSocket::TransitDescriptor socket_descriptor,
-      uint32_t length,
-      uint32_t total_segments,
       bool initially_muted) {
     // It's difficult to check that the sync socket and shared memory is
     // valid in the gmock macros, so we check them here.
     EXPECT_NE(base::SyncSocket::UnwrapHandle(socket_descriptor),
               base::SyncSocket::kInvalidHandle);
+    size_t length = handle.GetSize();
     base::SharedMemory memory(handle, /*read_only*/ true);
     EXPECT_TRUE(memory.Map(length));
-    renderer_->NotifyStreamCreated(stream_id, handle, socket_descriptor, length,
-                                   total_segments, initially_muted);
+    renderer_->NotifyStreamCreated(stream_id, handle, socket_descriptor,
+                                   initially_muted);
     EXPECT_TRUE(memory.Unmap());
     memory.Close();
   }
@@ -334,8 +331,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -360,8 +356,7 @@
 TEST_F(AudioInputRendererHostTest, CreateWithNonDefaultDevice) {
   int session_id = Open("Nondefault device", GetRawNondefaultId());
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -376,8 +371,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -399,8 +393,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -424,8 +417,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -445,8 +437,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -466,8 +457,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(renderer_, NotifyStreamError(kStreamId));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
@@ -487,10 +477,8 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
-  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId + 1, _, _, _,
-                                             kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId + 1, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated()).Times(2);
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -524,8 +512,7 @@
   int session_id =
       Open("Default device", media::AudioDeviceDescription::kDefaultDeviceId);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(
@@ -556,8 +543,7 @@
   base::RunLoop().RunUntilIdle();
   int session_id = Open("Tab capture", controls.audio.device_id);
 
-  EXPECT_CALL(renderer_,
-              NotifyStreamCreated(kStreamId, _, _, _, kSharedMemoryCount, _));
+  EXPECT_CALL(renderer_, NotifyStreamCreated(kStreamId, _, _, _));
   EXPECT_CALL(controller_factory_, ControllerCreated());
 
   airh_->OnMessageReceived(AudioInputHostMsg_CreateStream(

diff --git a/content/browser/renderer_host/media/audio_input_sync_writer.cc b/content/browser/renderer_host/media/audio_input_sync_writer.cc
index 723b6fc..a166a3114 100644
--- a/content/browser/renderer_host/media/audio_input_sync_writer.cc
+++ b/content/browser/renderer_host/media/audio_input_sync_writer.cc

@@ -126,12 +126,9 @@
   if (shared_memory_segment_count == 0)
     return nullptr;
 
-  base::CheckedNumeric<size_t> segment_size =
-      sizeof(media::AudioInputBufferParameters);
-  segment_size += media::AudioBus::CalculateMemorySize(params);
-
-  base::CheckedNumeric<size_t> requested_memory_size =
-      segment_size * shared_memory_segment_count;
+  base::CheckedNumeric<uint32_t> requested_memory_size =
+      media::ComputeAudioInputBufferSizeChecked(params,
+                                                shared_memory_segment_count);
 
   auto shared_memory = base::MakeUnique<base::SharedMemory>();
   if (!requested_memory_size.IsValid() ||

diff --git a/content/browser/renderer_host/media/audio_input_sync_writer_unittest.cc b/content/browser/renderer_host/media/audio_input_sync_writer_unittest.cc
index 985582c..5aea4d3 100644
--- a/content/browser/renderer_host/media/audio_input_sync_writer_unittest.cc
+++ b/content/browser/renderer_host/media/audio_input_sync_writer_unittest.cc

@@ -122,9 +122,8 @@
     const AudioParameters audio_params(
         AudioParameters::AUDIO_FAKE, media::CHANNEL_LAYOUT_MONO,
         sampling_frequency_hz, bits_per_sample, frames);
-    const uint32_t segment_size = sizeof(media::AudioInputBufferParameters) +
-                                  AudioBus::CalculateMemorySize(audio_params);
-    const size_t data_size = kSegments * segment_size;
+    const uint32_t data_size =
+        media::ComputeAudioInputBufferSize(audio_params, kSegments);
 
     auto shared_memory = base::MakeUnique<base::SharedMemory>();
     EXPECT_TRUE(shared_memory->CreateAndMapAnonymous(data_size));

diff --git a/content/browser/renderer_host/media/audio_renderer_host.cc b/content/browser/renderer_host/media/audio_renderer_host.cc
index b22f85da..5e3b88f 100644
--- a/content/browser/renderer_host/media/audio_renderer_host.cc
+++ b/content/browser/renderer_host/media/audio_renderer_host.cc

@@ -113,7 +113,6 @@
   }
 
   base::SyncSocket::TransitDescriptor socket_descriptor;
-  size_t shared_memory_size = shared_memory->requested_size();
 
   base::SharedMemoryHandle foreign_memory_handle =
       shared_memory->handle().Duplicate();
@@ -125,9 +124,8 @@
     return;
   }
 
-  Send(new AudioMsg_NotifyStreamCreated(
-      stream_id, foreign_memory_handle, socket_descriptor,
-      base::checked_cast<uint32_t>(shared_memory_size)));
+  Send(new AudioMsg_NotifyStreamCreated(stream_id, foreign_memory_handle,
+                                        socket_descriptor));
 }
 
 void AudioRendererHost::OnStreamError(int stream_id) {

diff --git a/content/browser/renderer_host/media/audio_renderer_host_unittest.cc b/content/browser/renderer_host/media/audio_renderer_host_unittest.cc
index ab76c47a..c1d45126 100644
--- a/content/browser/renderer_host/media/audio_renderer_host_unittest.cc
+++ b/content/browser/renderer_host/media/audio_renderer_host_unittest.cc

@@ -117,7 +117,7 @@
                     media::OutputDeviceStatus device_status,
                     const media::AudioParameters& output_params,
                     const std::string& matched_device_id));
-  MOCK_METHOD2(WasNotifiedOfCreation, void(int stream_id, int length));
+  MOCK_METHOD1(WasNotifiedOfCreation, void(int stream_id));
   MOCK_METHOD1(WasNotifiedOfError, void(int stream_id));
 
   void ShutdownForBadMessage() override { bad_msg_count++; }
@@ -171,13 +171,12 @@
   void OnNotifyStreamCreated(
       int stream_id,
       base::SharedMemoryHandle handle,
-      base::SyncSocket::TransitDescriptor socket_descriptor,
-      uint32_t length) {
+      base::SyncSocket::TransitDescriptor socket_descriptor) {
     // Maps the shared memory.
+    shared_memory_length_ = handle.GetSize();
     shared_memory_.reset(new base::SharedMemory(handle, false));
-    CHECK(shared_memory_->Map(length));
+    CHECK(shared_memory_->Map(shared_memory_length_));
     CHECK(shared_memory_->memory());
-    shared_memory_length_ = length;
 
     // Create the SyncSocket using the handle.
     base::SyncSocket::Handle sync_socket_handle =
@@ -185,7 +184,7 @@
     sync_socket_.reset(new base::SyncSocket(sync_socket_handle));
 
     // And then delegate the call to the mock method.
-    WasNotifiedOfCreation(stream_id, length);
+    WasNotifiedOfCreation(stream_id);
   }
 
   void OnNotifyStreamError(int stream_id) { WasNotifiedOfError(stream_id); }
@@ -322,7 +321,7 @@
                   OnDeviceAuthorized(kStreamId, expected_device_status, _, _));
 
     if (expected_device_status == media::OUTPUT_DEVICE_STATUS_OK) {
-      EXPECT_CALL(*host_.get(), WasNotifiedOfCreation(kStreamId, _));
+      EXPECT_CALL(*host_.get(), WasNotifiedOfCreation(kStreamId));
       EXPECT_CALL(mirroring_manager_,
                   AddDiverter(process()->GetID(), main_rfh()->GetRoutingID(),
                               NotNull()))
@@ -365,7 +364,7 @@
 
     // However, validation does not block stream creation, so these method calls
     // might be made:
-    EXPECT_CALL(*host_, WasNotifiedOfCreation(kStreamId, _)).Times(AtLeast(0));
+    EXPECT_CALL(*host_, WasNotifiedOfCreation(kStreamId)).Times(AtLeast(0));
     EXPECT_CALL(mirroring_manager_, AddDiverter(_, _, _)).Times(AtLeast(0));
     EXPECT_CALL(mirroring_manager_, RemoveDiverter(_)).Times(AtLeast(0));
 
@@ -404,7 +403,7 @@
                 OnDeviceAuthorized(kStreamId, media::OUTPUT_DEVICE_STATUS_OK, _,
                                    hashed_output_id))
         .Times(1);
-    EXPECT_CALL(*host_.get(), WasNotifiedOfCreation(kStreamId, _));
+    EXPECT_CALL(*host_.get(), WasNotifiedOfCreation(kStreamId));
     EXPECT_CALL(
         mirroring_manager_,
         AddDiverter(process()->GetID(), main_rfh()->GetRoutingID(), NotNull()))

diff --git a/content/browser/renderer_host/media/audio_sync_reader.cc b/content/browser/renderer_host/media/audio_sync_reader.cc
index bc2ce151..fad2322 100644
--- a/content/browser/renderer_host/media/audio_sync_reader.cc
+++ b/content/browser/renderer_host/media/audio_sync_reader.cc

@@ -54,7 +54,6 @@
           switches::kMuteAudio)),
       had_socket_error_(false),
       socket_(std::move(socket)),
-      packet_size_(shared_memory_->requested_size()),
       renderer_callback_count_(0),
       renderer_missed_callback_count_(0),
       trailing_renderer_missed_callback_count_(0),
@@ -65,9 +64,8 @@
       maximum_wait_time_(base::TimeDelta::FromMilliseconds(20)),
 #endif
       buffer_index_(0) {
-  DCHECK_EQ(static_cast<size_t>(packet_size_),
-            sizeof(media::AudioOutputBufferParameters) +
-                AudioBus::CalculateMemorySize(params));
+  DCHECK_EQ(base::checked_cast<uint32_t>(shared_memory_->requested_size()),
+            media::ComputeAudioOutputBufferSize(params));
   AudioOutputBuffer* buffer =
       reinterpret_cast<AudioOutputBuffer*>(shared_memory_->memory());
   output_bus_ = AudioBus::WrapMemory(params, buffer->audio);
@@ -122,8 +120,7 @@
     const media::AudioParameters& params,
     base::CancelableSyncSocket* foreign_socket) {
   base::CheckedNumeric<size_t> memory_size =
-      sizeof(media::AudioOutputBufferParameters);
-  memory_size += AudioBus::CalculateMemorySize(params);
+      media::ComputeAudioOutputBufferSizeChecked(params);
 
   std::unique_ptr<base::SharedMemory> shared_memory(new base::SharedMemory());
   std::unique_ptr<base::CancelableSyncSocket> socket(

diff --git a/content/browser/renderer_host/media/audio_sync_reader.h b/content/browser/renderer_host/media/audio_sync_reader.h
index c0fbf1cc..cdf55d7 100644
--- a/content/browser/renderer_host/media/audio_sync_reader.h
+++ b/content/browser/renderer_host/media/audio_sync_reader.h

@@ -82,9 +82,6 @@
   // Shared memory wrapper used for transferring audio data to Read() callers.
   std::unique_ptr<media::AudioBus> output_bus_;
 
-  // Maximum amount of audio data which can be transferred in one Read() call.
-  const int packet_size_;
-
   // Track the number of times the renderer missed its real-time deadline and
   // report a UMA stat during destruction.
   size_t renderer_callback_count_;

diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 678135b..35cb294 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc

@@ -1715,8 +1715,8 @@
       GetID(), blob_storage_context,
       make_scoped_refptr(storage_partition_impl_->GetFileSystemContext())));
   AddFilter(new FileUtilitiesMessageFilter(GetID()));
-  AddFilter(
-      new DatabaseMessageFilter(storage_partition_impl_->GetDatabaseTracker()));
+  AddFilter(new DatabaseMessageFilter(
+      GetID(), storage_partition_impl_->GetDatabaseTracker()));
 #if defined(OS_MACOSX)
   AddFilter(new TextInputClientMessageFilter());
 #elif defined(OS_WIN)

diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
index b72bce8..a633920 100644
--- a/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/content/browser/renderer_host/render_widget_host_impl.cc

@@ -31,6 +31,7 @@
 #include "build/build_config.h"
 #include "cc/base/switches.h"
 #include "cc/output/compositor_frame.h"
+#include "components/viz/common/switches.h"
 #include "components/viz/service/display_embedder/server_shared_bitmap_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
 #include "content/browser/bad_message.h"
@@ -307,6 +308,11 @@
   }
 };
 
+bool IsRunningInMash() {
+  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
+  return cmdline->HasSwitch(switches::kIsRunningInMash);
+}
+
 }  // namespace
 
 ///////////////////////////////////////////////////////////////////////////////
@@ -403,6 +409,12 @@
       base::Bind(&RenderWidgetHostImpl::ClearDisplayedGraphics,
                  weak_factory_.GetWeakPtr())));
 
+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  enable_surface_synchronization_ =
+      IsRunningInMash() ||
+      command_line.HasSwitch(switches::kEnableSurfaceSynchronization);
+
   delegate_->RenderWidgetCreated(this);
 }
 
@@ -780,14 +792,18 @@
       old_resize_params_->bottom_controls_height !=
           resize_params->bottom_controls_height ||
       old_resize_params_->visible_viewport_size !=
-          resize_params->visible_viewport_size;
+          resize_params->visible_viewport_size ||
+      (enable_surface_synchronization_ &&
+       old_resize_params_->local_surface_id != resize_params->local_surface_id);
 
   // We don't expect to receive an ACK when the requested size or the physical
   // backing size is empty, or when the main viewport size didn't change.
   resize_params->needs_resize_ack =
       g_check_for_pending_resize_ack && !resize_params->new_size.IsEmpty() &&
-      !resize_params->physical_backing_size.IsEmpty() && size_changed;
-
+      !resize_params->physical_backing_size.IsEmpty() && size_changed &&
+      (!enable_surface_synchronization_ ||
+       (resize_params->local_surface_id.has_value() &&
+        resize_params->local_surface_id->is_valid()));
   return dirty;
 }
 

diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
index b75d5e7..2ed5e1c 100644
--- a/content/browser/renderer_host/render_widget_host_impl.h
+++ b/content/browser/renderer_host/render_widget_host_impl.h

@@ -1024,6 +1024,8 @@
     viz::mojom::HitTestRegionListPtr hit_test_region_list;
   } saved_frame_;
 
+  bool enable_surface_synchronization_ = false;
+
   // If the |associated_widget_input_handler_| is set it should always be
   // used to ensure in order delivery of related messages that may occur
   // at the frame input level; see FrameInputHandler. Note that when the

diff --git a/content/browser/renderer_host/render_widget_host_view_child_frame.cc b/content/browser/renderer_host/render_widget_host_view_child_frame.cc
index ab01b8c..fc5197ab 100644
--- a/content/browser/renderer_host/render_widget_host_view_child_frame.cc
+++ b/content/browser/renderer_host/render_widget_host_view_child_frame.cc

@@ -590,6 +590,11 @@
   frame_connector_->ForwardProcessAckedTouchEvent(touch, ack_result);
 }
 
+void RenderWidgetHostViewChildFrame::DidStopFlinging() {
+  if (selection_controller_client_)
+    selection_controller_client_->DidStopFlinging();
+}
+
 bool RenderWidgetHostViewChildFrame::LockMouse() {
   if (frame_connector_)
     return frame_connector_->LockMouse();

diff --git a/content/browser/renderer_host/render_widget_host_view_child_frame.h b/content/browser/renderer_host/render_widget_host_view_child_frame.h
index 7a6cb8fb..e994ab27f 100644
--- a/content/browser/renderer_host/render_widget_host_view_child_frame.h
+++ b/content/browser/renderer_host/render_widget_host_view_child_frame.h

@@ -127,6 +127,7 @@
   gfx::Rect GetBoundsInRootWindow() override;
   void ProcessAckedTouchEvent(const TouchEventWithLatencyInfo& touch,
                               InputEventAckState ack_result) override;
+  void DidStopFlinging() override;
   bool LockMouse() override;
   void UnlockMouse() override;
   viz::FrameSinkId GetFrameSinkId() override;

diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index 84897ae..0fb7a0e 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm

@@ -794,8 +794,6 @@
 void RenderWidgetHostViewMac::SetBounds(const gfx::Rect& rect) {
   // |rect.size()| is view coordinates, |rect.origin| is screen coordinates,
   // TODO(thakis): fix, http://crbug.com/73362
-  if (render_widget_host_->is_hidden())
-    return;
 
   // During the initial creation of the RenderWidgetHostView in
   // WebContentsImpl::CreateRenderViewForRenderManager, SetSize is called with

diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index 241fcb55..9502302 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc

@@ -139,7 +139,7 @@
 ResourceRequest CreateXHRRequestWithOrigin(const char* origin) {
   ResourceRequest request = CreateXHRRequest("http://bar.com/simple_page.html");
   request.site_for_cookies = GURL(origin);
-  request.headers = base::StringPrintf("Origin: %s\r\n", origin);
+  request.headers.SetHeader(net::HttpRequestHeaders::kOrigin, origin);
   return request;
 }
 

diff --git a/content/browser/service_worker/service_worker_controllee_request_handler.cc b/content/browser/service_worker/service_worker_controllee_request_handler.cc
index 19acfff..8be993b 100644
--- a/content/browser/service_worker/service_worker_controllee_request_handler.cc
+++ b/content/browser/service_worker/service_worker_controllee_request_handler.cc

@@ -213,9 +213,7 @@
 #if BUILDFLAG(ENABLE_OFFLINE_PAGES)
   // Fall back for the subsequent offline page interceptor to load the offline
   // snapshot of the page if required.
-  net::HttpRequestHeaders extra_request_headers;
-  extra_request_headers.AddHeadersFromString(resource_request.headers);
-  if (ShouldFallbackToLoadOfflinePage(extra_request_headers)) {
+  if (ShouldFallbackToLoadOfflinePage(resource_request.headers)) {
     std::move(callback).Run(StartLoaderCallback());
     return;
   }

diff --git a/content/browser/service_worker/service_worker_fetch_dispatcher.cc b/content/browser/service_worker/service_worker_fetch_dispatcher.cc
index 4e01ed4..d4ffc47b 100644
--- a/content/browser/service_worker/service_worker_fetch_dispatcher.cc
+++ b/content/browser/service_worker/service_worker_fetch_dispatcher.cc

@@ -654,9 +654,9 @@
       version_->navigation_preload_state().header));
   ServiceWorkerMetrics::RecordNavigationPreloadRequestHeaderSize(
       version_->navigation_preload_state().header.length());
-  request.headers = "Service-Worker-Navigation-Preload: " +
-                    version_->navigation_preload_state().header + "\r\n" +
-                    original_request->extra_request_headers().ToString();
+  request.headers.CopyFrom(original_request->extra_request_headers());
+  request.headers.SetHeader("Service-Worker-Navigation-Preload",
+                            version_->navigation_preload_state().header);
 
   const int request_id = ResourceDispatcherHostImpl::Get()->MakeRequestID();
   DCHECK_LT(request_id, -1);

diff --git a/content/browser/speech/OWNERS b/content/browser/speech/OWNERS
index ab77f5bf..cfcf5d6 100644
--- a/content/browser/speech/OWNERS
+++ b/content/browser/speech/OWNERS

@@ -1,3 +1,4 @@
-tommi@chromium.org
+olka@chromium.org
+maxmorin@chromium.org
 
 # COMPONENT: Blink>Speech

diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
index dcd12d2..a65c893 100644
--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc

@@ -689,7 +689,7 @@
   int process_id = bindings_.dispatch_context();
   if (!ChildProcessSecurityPolicy::GetInstance()->CanAccessDataForOrigin(
           process_id, origin.GetURL())) {
-    mojo::ReportBadMessage("Access denied for localStorage request");
+    bindings_.ReportBadMessage("Access denied for localStorage request");
     return;
   }
   dom_storage_context_->OpenLocalStorage(origin, std::move(request));
@@ -1003,10 +1003,10 @@
   return browser_context_;
 }
 
-void StoragePartitionImpl::Bind(
+mojo::BindingId StoragePartitionImpl::Bind(
     int process_id,
     mojo::InterfaceRequest<mojom::StoragePartitionService> request) {
-  bindings_.AddBinding(this, std::move(request), process_id);
+  return bindings_.AddBinding(this, std::move(request), process_id);
 }
 
 void StoragePartitionImpl::OverrideQuotaManagerForTesting(

diff --git a/content/browser/storage_partition_impl.h b/content/browser/storage_partition_impl.h
index b5902ac7..47137cf 100644
--- a/content/browser/storage_partition_impl.h
+++ b/content/browser/storage_partition_impl.h

@@ -135,9 +135,13 @@
   // Can return nullptr while |this| is being destroyed.
   BrowserContext* browser_context() const;
 
-  // Called by each renderer process once.
-  void Bind(int process_id,
-            mojo::InterfaceRequest<mojom::StoragePartitionService> request);
+  // Called by each renderer process once. Returns the id of the created
+  // binding.
+  mojo::BindingId Bind(
+      int process_id,
+      mojo::InterfaceRequest<mojom::StoragePartitionService> request);
+
+  auto& bindings_for_testing() { return bindings_; }
 
   struct DataDeletionHelper;
   struct QuotaManagedDataDeletionHelper;

diff --git a/content/browser/web_contents/web_contents_view_mac.mm b/content/browser/web_contents/web_contents_view_mac.mm
index a9111f9..219ae6db 100644
--- a/content/browser/web_contents/web_contents_view_mac.mm
+++ b/content/browser/web_contents/web_contents_view_mac.mm

@@ -370,9 +370,9 @@
                                              is_guest_view_hack)
           : new RenderWidgetHostViewMac(render_widget_host, is_guest_view_hack);
   if (delegate()) {
-    base::scoped_nsobject<NSObject<RenderWidgetHostViewMacDelegate> >
-        rw_delegate(
-            delegate()->CreateRenderWidgetHostViewDelegate(render_widget_host));
+    base::scoped_nsobject<NSObject<RenderWidgetHostViewMacDelegate>>
+        rw_delegate(delegate()->CreateRenderWidgetHostViewDelegate(
+            render_widget_host, false));
 
     view->SetDelegate(rw_delegate.get());
   }
@@ -402,7 +402,15 @@
 
 RenderWidgetHostViewBase* WebContentsViewMac::CreateViewForPopupWidget(
     RenderWidgetHost* render_widget_host) {
-  return new RenderWidgetHostViewMac(render_widget_host, false);
+  RenderWidgetHostViewMac* view =
+      new RenderWidgetHostViewMac(render_widget_host, false);
+  if (delegate()) {
+    base::scoped_nsobject<NSObject<RenderWidgetHostViewMacDelegate>>
+        rw_delegate(delegate()->CreateRenderWidgetHostViewDelegate(
+            render_widget_host, true));
+    view->SetDelegate(rw_delegate.get());
+  }
+  return view;
 }
 
 void WebContentsViewMac::SetPageTitle(const base::string16& title) {

diff --git a/content/browser/webui/web_ui_url_loader_factory.cc b/content/browser/webui/web_ui_url_loader_factory.cc
index 3c49b85..82382f38 100644
--- a/content/browser/webui/web_ui_url_loader_factory.cc
+++ b/content/browser/webui/web_ui_url_loader_factory.cc

@@ -156,10 +156,8 @@
   std::string path;
   URLDataManagerBackend::URLToRequestPath(request.url, &path);
 
-  net::HttpRequestHeaders request_headers;
-  request_headers.AddHeadersFromString(request.headers);
   std::string origin_header;
-  request_headers.GetHeader(net::HttpRequestHeaders::kOrigin, &origin_header);
+  request.headers.GetHeader(net::HttpRequestHeaders::kOrigin, &origin_header);
 
   scoped_refptr<net::HttpResponseHeaders> headers =
       URLDataManagerBackend::GetHeaders(source, path, origin_header);

diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
index 405f820ef..bc8e5ea 100644
--- a/content/child/BUILD.gn
+++ b/content/child/BUILD.gn

@@ -73,8 +73,6 @@
     "content_child_helpers.h",
     "database_util.cc",
     "database_util.h",
-    "db_message_filter.cc",
-    "db_message_filter.h",
     "dwrite_font_proxy/dwrite_font_proxy_init_win.cc",
     "dwrite_font_proxy/dwrite_font_proxy_init_win.h",
     "dwrite_font_proxy/dwrite_font_proxy_win.cc",
@@ -194,6 +192,8 @@
     "v8_value_converter_impl.h",
     "web_data_consumer_handle_impl.cc",
     "web_data_consumer_handle_impl.h",
+    "web_database_impl.cc",
+    "web_database_impl.h",
     "web_database_observer_impl.cc",
     "web_database_observer_impl.h",
     "web_url_loader_impl.cc",

diff --git a/content/child/appcache/appcache_dispatcher.cc b/content/child/appcache/appcache_dispatcher.cc
index 02986b1..0685219 100644
--- a/content/child/appcache/appcache_dispatcher.cc
+++ b/content/child/appcache/appcache_dispatcher.cc

@@ -26,6 +26,8 @@
     IPC_MESSAGE_HANDLER(AppCacheMsg_ErrorEventRaised, OnErrorEventRaised)
     IPC_MESSAGE_HANDLER(AppCacheMsg_LogMessage, OnLogMessage)
     IPC_MESSAGE_HANDLER(AppCacheMsg_ContentBlocked, OnContentBlocked)
+    IPC_MESSAGE_HANDLER(AppCacheMsg_SetSubresourceFactory,
+                        OnSetSubresourceFactory)
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
   return handled;
@@ -69,4 +71,10 @@
   frontend_->OnContentBlocked(host_id, manifest_url);
 }
 
+void AppCacheDispatcher::OnSetSubresourceFactory(
+    int host_id,
+    mojo::MessagePipeHandle loader_factory_pipe) {
+  frontend_->OnSetSubresourceFactory(host_id, loader_factory_pipe);
+}
+
 }  // namespace content

diff --git a/content/child/appcache/appcache_dispatcher.h b/content/child/appcache/appcache_dispatcher.h
index f556756..2b43dc7 100644
--- a/content/child/appcache/appcache_dispatcher.h
+++ b/content/child/appcache/appcache_dispatcher.h

@@ -12,6 +12,7 @@
 #include "content/child/appcache/appcache_backend_proxy.h"
 #include "content/common/appcache_interfaces.h"
 #include "ipc/ipc_listener.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 
 namespace content {
 
@@ -43,7 +44,8 @@
                           const AppCacheErrorDetails& details);
   void OnLogMessage(int host_id, int log_level, const std::string& message);
   void OnContentBlocked(int host_id, const GURL& manifest_url);
-
+  void OnSetSubresourceFactory(int host_id,
+                               mojo::MessagePipeHandle loader_factory_pipe);
   AppCacheBackendProxy backend_proxy_;
   std::unique_ptr<AppCacheFrontend> frontend_;
 };

diff --git a/content/child/appcache/appcache_frontend_impl.cc b/content/child/appcache/appcache_frontend_impl.cc
index 2dc5d9b2..448ab75c 100644
--- a/content/child/appcache/appcache_frontend_impl.cc
+++ b/content/child/appcache/appcache_frontend_impl.cc

@@ -87,6 +87,14 @@
     host->OnContentBlocked(manifest_url);
 }
 
+void AppCacheFrontendImpl::OnSetSubresourceFactory(
+    int host_id,
+    mojo::MessagePipeHandle loader_factory_pipe_handle) {
+  WebApplicationCacheHostImpl* host = GetHost(host_id);
+  if (host)
+    host->SetSubresourceFactory(loader_factory_pipe_handle);
+}
+
 // Ensure that enum values never get out of sync with the
 // ones declared for use within the WebKit api
 

diff --git a/content/child/appcache/appcache_frontend_impl.h b/content/child/appcache/appcache_frontend_impl.h
index e0bbdc6..65ad617 100644
--- a/content/child/appcache/appcache_frontend_impl.h
+++ b/content/child/appcache/appcache_frontend_impl.h

@@ -26,6 +26,9 @@
                     AppCacheLogLevel log_level,
                     const std::string& message) override;
   void OnContentBlocked(int host_id, const GURL& manifest_url) override;
+  void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override;
 };
 
 }  // namespace content

diff --git a/content/child/appcache/web_application_cache_host_impl.h b/content/child/appcache/web_application_cache_host_impl.h
index 1c2fa073..caffefd 100644
--- a/content/child/appcache/web_application_cache_host_impl.h
+++ b/content/child/appcache/web_application_cache_host_impl.h

@@ -8,6 +8,7 @@
 #include <string>
 
 #include "content/common/appcache_interfaces.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 #include "third_party/WebKit/public/platform/WebApplicationCacheHost.h"
 #include "third_party/WebKit/public/platform/WebApplicationCacheHostClient.h"
 #include "third_party/WebKit/public/platform/WebURLResponse.h"
@@ -56,6 +57,12 @@
   void GetAssociatedCacheInfo(CacheInfo* info) override;
   int GetHostID() const override;
 
+  // In the network service world, the |loader_factory_pipe| parameter contains
+  // the message pipe for the URLLoaderFactory instance to be used for
+  // subresource requests.
+  virtual void SetSubresourceFactory(
+      mojo::MessagePipeHandle loader_factory_pipe_handle) {}
+
  private:
   enum IsNewMasterEntry { MAYBE_NEW_ENTRY, NEW_ENTRY, OLD_ENTRY };
 

diff --git a/content/child/blob_storage/blob_transport_controller_unittest.cc b/content/child/blob_storage/blob_transport_controller_unittest.cc
index 9bbb64d..b7c054d 100644
--- a/content/child/blob_storage/blob_transport_controller_unittest.cc
+++ b/content/child/blob_storage/blob_transport_controller_unittest.cc

@@ -138,7 +138,7 @@
     EXPECT_EQ(expected_uuid, std::get<0>(register_contents));
     EXPECT_EQ(expected_content_type, std::get<1>(register_contents));
     if (descriptions)
-      *descriptions = std::get<3>(register_contents);
+      *descriptions = std::get<3>(std::move(register_contents));
     // We don't have dispositions from the renderer.
     EXPECT_TRUE(std::get<2>(register_contents).empty());
     sink_.ClearMessages();

diff --git a/content/child/db_message_filter.cc b/content/child/db_message_filter.cc
deleted file mode 100644
index a740977..0000000
--- a/content/child/db_message_filter.cc
+++ /dev/null

@@ -1,50 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/child/db_message_filter.h"
-
-#include "content/common/database_messages.h"
-#include "storage/common/database/database_identifier.h"
-#include "third_party/WebKit/public/platform/WebSecurityOrigin.h"
-#include "third_party/WebKit/public/platform/WebString.h"
-#include "third_party/WebKit/public/platform/WebURL.h"
-#include "third_party/WebKit/public/web/WebDatabase.h"
-#include "url/origin.h"
-
-using blink::WebSecurityOrigin;
-using blink::WebString;
-
-namespace content {
-
-DBMessageFilter::DBMessageFilter() {
-}
-
-bool DBMessageFilter::OnMessageReceived(const IPC::Message& message) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(DBMessageFilter, message)
-    IPC_MESSAGE_HANDLER(DatabaseMsg_UpdateSize, OnDatabaseUpdateSize)
-    IPC_MESSAGE_HANDLER(DatabaseMsg_CloseImmediately,
-                        OnDatabaseCloseImmediately)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
-void DBMessageFilter::OnDatabaseUpdateSize(const url::Origin& origin,
-                                           const base::string16& database_name,
-                                           int64_t database_size) {
-  DCHECK(!origin.unique());
-  blink::WebDatabase::UpdateDatabaseSize(
-      origin, WebString::FromUTF16(database_name), database_size);
-}
-
-void DBMessageFilter::OnDatabaseCloseImmediately(
-    const url::Origin& origin,
-    const base::string16& database_name) {
-  DCHECK(!origin.unique());
-  blink::WebDatabase::CloseDatabaseImmediately(
-      origin, WebString::FromUTF16(database_name));
-}
-
-}  // namespace content

diff --git a/content/child/db_message_filter.h b/content/child/db_message_filter.h
deleted file mode 100644
index f0d91c44..0000000
--- a/content/child/db_message_filter.h
+++ /dev/null

@@ -1,41 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_CHILD_DB_MESSAGE_FILTER_H_
-#define CONTENT_CHILD_DB_MESSAGE_FILTER_H_
-
-#include <stdint.h>
-
-#include "base/strings/string16.h"
-#include "ipc/message_filter.h"
-
-namespace url {
-class Origin;
-}  // namespace url
-
-namespace content {
-
-// Receives database messages from the browser process and processes them on the
-// IO thread.
-class DBMessageFilter : public IPC::MessageFilter {
- public:
-  DBMessageFilter();
-
-  // IPC::MessageFilter
-  bool OnMessageReceived(const IPC::Message& message) override;
-
- protected:
-  ~DBMessageFilter() override {}
-
- private:
-  void OnDatabaseUpdateSize(const url::Origin& origin,
-                            const base::string16& database_name,
-                            int64_t database_size);
-  void OnDatabaseCloseImmediately(const url::Origin& origin,
-                                  const base::string16& database_name);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_CHILD_DB_MESSAGE_FILTER_H_

diff --git a/content/child/resource_dispatcher.cc b/content/child/resource_dispatcher.cc
index e631a12..5dd3689 100644
--- a/content/child/resource_dispatcher.cc
+++ b/content/child/resource_dispatcher.cc

@@ -593,8 +593,9 @@
     base::WaitableEvent event(base::WaitableEvent::ResetPolicy::MANUAL,
                               base::WaitableEvent::InitialState::NOT_SIGNALED);
 
-    // TODO(reillyg): Support passing URLLoaderThrottles to this task.
-    DCHECK_EQ(0u, throttles.size());
+    // Prepare the configured throttles for use on a separate thread.
+    for (const auto& throttle : throttles)
+      throttle->DetachFromCurrentSequence();
 
     // A task is posted to a separate thread to execute the request so that
     // this thread may block on a waitable event. It is safe to pass raw
@@ -604,7 +605,7 @@
         FROM_HERE,
         base::BindOnce(&SyncLoadContext::StartAsyncWithWaitableEvent,
                        std::move(request), routing_id, frame_origin,
-                       std::move(url_loader_factory_copy),
+                       std::move(url_loader_factory_copy), std::move(throttles),
                        base::Unretained(response), base::Unretained(&event)));
 
     event.Wait();

diff --git a/content/child/sync_load_context.cc b/content/child/sync_load_context.cc
index e7ee0fc..08171352 100644
--- a/content/child/sync_load_context.cc
+++ b/content/child/sync_load_context.cc

@@ -22,12 +22,11 @@
     int routing_id,
     const url::Origin& frame_origin,
     mojom::URLLoaderFactoryPtrInfo url_loader_factory_pipe,
+    std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
     SyncLoadResponse* response,
     base::WaitableEvent* event) {
   auto* context = new SyncLoadContext(
       request.get(), std::move(url_loader_factory_pipe), response, event);
-  // TODO(reillyg): Support throttles.
-  std::vector<std::unique_ptr<URLLoaderThrottle>> throttles;
 
   context->request_id_ = context->resource_dispatcher_->StartAsync(
       std::move(request), routing_id, nullptr, frame_origin, true /* is_sync */,

diff --git a/content/child/sync_load_context.h b/content/child/sync_load_context.h
index 5323023..d2df986 100644
--- a/content/child/sync_load_context.h
+++ b/content/child/sync_load_context.h

@@ -35,6 +35,7 @@
       int routing_id,
       const url::Origin& frame_origin,
       mojom::URLLoaderFactoryPtrInfo url_loader_factory_pipe,
+      std::vector<std::unique_ptr<URLLoaderThrottle>> throttles,
       SyncLoadResponse* response,
       base::WaitableEvent* event);
 

diff --git a/content/child/web_database_impl.cc b/content/child/web_database_impl.cc
new file mode 100644
index 0000000..7830e32
--- /dev/null
+++ b/content/child/web_database_impl.cc

@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/web_database_impl.h"
+
+#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "third_party/WebKit/public/platform/WebSecurityOrigin.h"
+#include "third_party/WebKit/public/platform/WebString.h"
+#include "third_party/WebKit/public/web/WebDatabase.h"
+#include "url/origin.h"
+
+using blink::WebSecurityOrigin;
+using blink::WebString;
+
+namespace content {
+
+WebDatabaseImpl::WebDatabaseImpl() = default;
+
+WebDatabaseImpl::~WebDatabaseImpl() = default;
+
+void WebDatabaseImpl::Create(content::mojom::WebDatabaseRequest request) {
+  mojo::MakeStrongBinding(base::MakeUnique<WebDatabaseImpl>(),
+                          std::move(request));
+}
+
+void WebDatabaseImpl::UpdateSize(const url::Origin& origin,
+                                 const base::string16& name,
+                                 int64_t size) {
+  DCHECK(!origin.unique());
+  blink::WebDatabase::UpdateDatabaseSize(origin, WebString::FromUTF16(name),
+                                         size);
+}
+
+void WebDatabaseImpl::CloseImmediately(const url::Origin& origin,
+                                       const base::string16& name) {
+  DCHECK(!origin.unique());
+  blink::WebDatabase::CloseDatabaseImmediately(origin,
+                                               WebString::FromUTF16(name));
+}
+
+}  // namespace content

diff --git a/content/child/web_database_impl.h b/content/child/web_database_impl.h
new file mode 100644
index 0000000..66a92fbe
--- /dev/null
+++ b/content/child/web_database_impl.h

@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_WEB_DATABASE_IMPL_H_
+#define CONTENT_CHILD_WEB_DATABASE_IMPL_H_
+
+#include <stdint.h>
+
+#include "base/strings/string16.h"
+#include "content/common/web_database.mojom.h"
+
+namespace url {
+class Origin;
+}  // namespace url
+
+namespace content {
+
+// Receives database messages from the browser process and processes them on the
+// IO thread.
+class WebDatabaseImpl : public content::mojom::WebDatabase {
+ public:
+  WebDatabaseImpl();
+  ~WebDatabaseImpl() override;
+
+  static void Create(content::mojom::WebDatabaseRequest);
+
+ private:
+  // content::mojom::Database:
+  void UpdateSize(const url::Origin& origin,
+                  const base::string16& name,
+                  int64_t size) override;
+  void CloseImmediately(const url::Origin& origin,
+                        const base::string16& name) override;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_WEB_DATABASE_IMPL_H_

diff --git a/content/child/web_url_request_util.cc b/content/child/web_url_request_util.cc
index ce7efda..1081d7c 100644
--- a/content/child/web_url_request_util.cc
+++ b/content/child/web_url_request_util.cc

@@ -14,6 +14,7 @@
 #include "content/child/request_extra_data.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
+#include "net/http/http_util.h"
 #include "third_party/WebKit/public/platform/FilePathConversion.h"
 #include "third_party/WebKit/public/platform/WebCachePolicy.h"
 #include "third_party/WebKit/public/platform/WebData.h"
@@ -31,6 +32,39 @@
 
 namespace {
 
+std::string TrimLWSAndCRLF(const base::StringPiece& input) {
+  base::StringPiece string = net::HttpUtil::TrimLWS(input);
+  const char* begin = string.data();
+  const char* end = string.data() + string.size();
+  while (begin < end && (end[-1] == '\r' || end[-1] == '\n'))
+    --end;
+  return std::string(base::StringPiece(begin, end - begin));
+}
+
+class HttpRequestHeadersVisitor : public blink::WebHTTPHeaderVisitor {
+ public:
+  explicit HttpRequestHeadersVisitor(net::HttpRequestHeaders* headers)
+      : headers_(headers) {}
+  ~HttpRequestHeadersVisitor() override = default;
+
+  void VisitHeader(const WebString& name, const WebString& value) override {
+    std::string name_latin1 = name.Latin1();
+    std::string value_latin1 = TrimLWSAndCRLF(value.Latin1());
+
+    // Skip over referrer headers found in the header map because we already
+    // pulled it out as a separate parameter.
+    if (base::LowerCaseEqualsASCII(name_latin1, "referer"))
+      return;
+
+    DCHECK(net::HttpUtil::IsValidHeaderName(name_latin1)) << name_latin1;
+    DCHECK(net::HttpUtil::IsValidHeaderValue(value_latin1)) << value_latin1;
+    headers_->SetHeader(name_latin1, value_latin1);
+  }
+
+ private:
+  net::HttpRequestHeaders* const headers_;
+};
+
 class HeaderFlattener : public blink::WebHTTPHeaderVisitor {
  public:
   HeaderFlattener() {}
@@ -180,7 +214,16 @@
   return WebURLRequestContextToResourceType(request_context);
 }
 
-std::string GetWebURLRequestHeaders(const WebURLRequest& request) {
+net::HttpRequestHeaders GetWebURLRequestHeaders(
+    const blink::WebURLRequest& request) {
+  net::HttpRequestHeaders headers;
+  HttpRequestHeadersVisitor visitor(&headers);
+  request.VisitHTTPHeaderFields(&visitor);
+  return headers;
+}
+
+std::string GetWebURLRequestHeadersAsString(
+    const blink::WebURLRequest& request) {
   HeaderFlattener flattener;
   request.VisitHTTPHeaderFields(&flattener);
   return flattener.GetBuffer();

diff --git a/content/child/web_url_request_util.h b/content/child/web_url_request_util.h
index 77c92cc..f7f8a88 100644
--- a/content/child/web_url_request_util.h
+++ b/content/child/web_url_request_util.h

@@ -13,6 +13,7 @@
 #include "content/public/common/resource_request_body.h"
 #include "content/public/common/resource_type.h"
 #include "content/public/common/service_worker_modes.h"
+#include "net/http/http_request_headers.h"
 #include "third_party/WebKit/public/platform/WebMixedContentContextType.h"
 #include "third_party/WebKit/public/platform/WebURLRequest.h"
 
@@ -28,7 +29,11 @@
 CONTENT_EXPORT ResourceType WebURLRequestToResourceType(
     const blink::WebURLRequest& request);
 
-std::string GetWebURLRequestHeaders(const blink::WebURLRequest& request);
+net::HttpRequestHeaders GetWebURLRequestHeaders(
+    const blink::WebURLRequest& request);
+
+std::string GetWebURLRequestHeadersAsString(
+    const blink::WebURLRequest& request);
 
 int GetLoadFlagsForWebURLRequest(const blink::WebURLRequest& request);
 

diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index d79158de..f8ad84c3 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn

@@ -638,6 +638,7 @@
     "service_worker/service_worker_types.mojom",
     "storage_partition_service.mojom",
     "video_capture.mojom",
+    "web_database.mojom",
     "widget.mojom",
   ]
 

diff --git a/content/common/appcache_interfaces.h b/content/common/appcache_interfaces.h
index da5373c8..74defd08 100644
--- a/content/common/appcache_interfaces.h
+++ b/content/common/appcache_interfaces.h

@@ -11,6 +11,7 @@
 
 #include "base/files/file_path.h"
 #include "content/public/common/appcache_info.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 
 namespace net {
 class URLRequest;
@@ -132,6 +133,13 @@
                                 const GURL& manifest_url) = 0;
   virtual void OnLogMessage(int host_id, AppCacheLogLevel log_level,
                             const std::string& message) = 0;
+  // In the network service world, we pass the URLLoaderFactory instance to be
+  // used to issue subresource requeste in the |loader_factory_pipe_handle|
+  // parameter.
+  virtual void OnSetSubresourceFactory(
+      int host_id,
+      mojo::MessagePipeHandle loader_factory_pipe_handle) = 0;
+
   virtual ~AppCacheFrontend() {}
 };
 

diff --git a/content/common/appcache_messages.h b/content/common/appcache_messages.h
index 23bb677d..38f6b48 100644
--- a/content/common/appcache_messages.h
+++ b/content/common/appcache_messages.h

@@ -10,6 +10,7 @@
 #include <stdint.h>
 
 #include "content/common/appcache_interfaces.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 #include "url/ipc/url_param_traits.h"
 
 #define IPC_MESSAGE_START AppCacheMsgStart
@@ -162,4 +163,10 @@
                      int /* host_id */,
                      GURL /* manifest_url */)
 
+// In the network service world this message sets the URLLoaderFactory to be
+// used for subresources.
+IPC_MESSAGE_CONTROL2(AppCacheMsg_SetSubresourceFactory,
+                     int /* host_id */,
+                     mojo::MessagePipeHandle /* url_loader_factory */)
+
 #endif  // CONTENT_COMMON_APPCACHE_MESSAGES_H_

diff --git a/content/common/browser_plugin/browser_plugin_messages.h b/content/common/browser_plugin/browser_plugin_messages.h
index 2cdec7c..c147db29 100644
--- a/content/common/browser_plugin/browser_plugin_messages.h
+++ b/content/common/browser_plugin/browser_plugin_messages.h

@@ -8,6 +8,7 @@
 #include <string>
 
 #include "base/process/process.h"
+#include "cc/ipc/cc_param_traits.h"
 #include "components/viz/common/surfaces/surface_info.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
@@ -152,9 +153,10 @@
                      int /* browser_plugin_instance_id */)
 
 // Sent when plugin's position has changed.
-IPC_MESSAGE_CONTROL2(BrowserPluginHostMsg_UpdateGeometry,
+IPC_MESSAGE_CONTROL3(BrowserPluginHostMsg_UpdateGeometry,
                      int /* browser_plugin_instance_id */,
-                     gfx::Rect /* view_rect */)
+                     gfx::Rect /* view_rect */,
+                     viz::LocalSurfaceId /* local_surface_id */)
 
 IPC_MESSAGE_ROUTED2(BrowserPluginHostMsg_SatisfySequence,
                     int /* browser_plugin_instance_id */,
@@ -173,8 +175,9 @@
 IPC_MESSAGE_CONTROL1(BrowserPluginMsg_GuestGone,
                      int /* browser_plugin_instance_id */)
 
-IPC_MESSAGE_CONTROL1(BrowserPluginMsg_GuestReady,
-                     int /* browser_plugin_instance_id */)
+IPC_MESSAGE_CONTROL2(BrowserPluginMsg_GuestReady,
+                     int /* browser_plugin_instance_id */,
+                     viz::FrameSinkId /* frame_sink_id */)
 
 // When the user tabs to the end of the tab stops of a guest, the browser
 // process informs the embedder to tab out of the browser plugin.

diff --git a/content/common/child_process_host_impl.cc b/content/common/child_process_host_impl.cc
index be4bae9..55ba42c8c 100644
--- a/content/common/child_process_host_impl.cc
+++ b/content/common/child_process_host_impl.cc

@@ -187,8 +187,7 @@
   // The hash value is incremented so that the tracing id is never equal to
   // MemoryDumpManager::kInvalidTracingProcessId.
   return static_cast<uint64_t>(
-             base::Hash(reinterpret_cast<const char*>(&child_process_id),
-                        sizeof(child_process_id))) +
+             base::Hash(&child_process_id, sizeof(child_process_id))) +
          1;
 }
 

diff --git a/content/common/database_messages.h b/content/common/database_messages.h
index 25143b2..980b34a2 100644
--- a/content/common/database_messages.h
+++ b/content/common/database_messages.h

@@ -14,19 +14,6 @@
 
 #define IPC_MESSAGE_START DatabaseMsgStart
 
-// Database messages sent from the browser to the renderer.
-
-// Notifies the child process of the new database size
-IPC_MESSAGE_CONTROL3(DatabaseMsg_UpdateSize,
-                     url::Origin /* the origin */,
-                     base::string16 /* the database name */,
-                     int64_t /* the new database size */)
-
-// Asks the child process to close a database immediately
-IPC_MESSAGE_CONTROL2(DatabaseMsg_CloseImmediately,
-                     url::Origin /* the origin */,
-                     base::string16 /* the database name */)
-
 // Database messages sent from the renderer to the browser.
 
 // Asks the browser process to open a DB file with the given name.

diff --git a/content/common/media/audio_messages.h b/content/common/media/audio_messages.h
index 888396f8..c4c2f353 100644
--- a/content/common/media/audio_messages.h
+++ b/content/common/media/audio_messages.h

@@ -48,23 +48,18 @@
 // buffer it shares with the browser process. It is also given a SyncSocket that
 // it uses to communicate with the browser process about the state of the
 // buffered audio data.
-IPC_MESSAGE_CONTROL4(
-    AudioMsg_NotifyStreamCreated,
-    int /* stream id */,
-    base::SharedMemoryHandle /* handle */,
-    base::SyncSocket::TransitDescriptor /* socket descriptor */,
-    uint32_t /* length */)
+IPC_MESSAGE_CONTROL(AudioMsg_NotifyStreamCreated,
+                    int /* stream id */,
+                    base::SharedMemoryHandle /* handle */,
+                    base::SyncSocket::TransitDescriptor /* socket descriptor */)
 
 // Tell the renderer process that an audio input stream has been created.
 // The renderer process would be given a SyncSocket that it should read from
-// from then on. It is also given number of segments in shared memory and
-// whether the stream initially is muted.
+// from then on. It is also given whether the stream initially is muted.
 IPC_MESSAGE_CONTROL(AudioInputMsg_NotifyStreamCreated,
                     int /* stream id */,
                     base::SharedMemoryHandle /* handle */,
                     base::SyncSocket::TransitDescriptor /* socket descriptor */,
-                    uint32_t /* length */,
-                    uint32_t /* segment count */,
                     bool /* initially muted */)
 
 // Notification message sent from AudioRendererHost to renderer for state

diff --git a/content/common/site_isolation_policy.cc b/content/common/site_isolation_policy.cc
index 5612596a..8ee09a9 100644
--- a/content/common/site_isolation_policy.cc
+++ b/content/common/site_isolation_policy.cc

@@ -14,7 +14,8 @@
 // static
 bool SiteIsolationPolicy::UseDedicatedProcessesForAllSites() {
   return base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kSitePerProcess);
+             switches::kSitePerProcess) ||
+         base::FeatureList::IsEnabled(features::kSitePerProcess);
 }
 
 // static

diff --git a/content/common/web_database.mojom b/content/common/web_database.mojom
new file mode 100644
index 0000000..6561fca21
--- /dev/null
+++ b/content/common/web_database.mojom

@@ -0,0 +1,19 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+import "mojo/common/string16.mojom";
+import "url/mojo/origin.mojom";
+
+// WebDatabase messages sent from the browser to the renderer.
+interface WebDatabase {
+  // Notifies the renderer process of the new database size.
+  UpdateSize(url.mojom.Origin origin,
+             mojo.common.mojom.String16 name,
+             int64 size);
+
+  // Asks the renderer process to close a database immediately.
+  CloseImmediately(url.mojom.Origin origin, mojo.common.mojom.String16 name);
+};

diff --git a/content/network/url_loader_impl.cc b/content/network/url_loader_impl.cc
index 40e38e56..c6f6a6cf 100644
--- a/content/network/url_loader_impl.cc
+++ b/content/network/url_loader_impl.cc

@@ -192,9 +192,7 @@
   const Referrer referrer(request.referrer, request.referrer_policy);
   Referrer::SetReferrerForRequest(url_request_.get(), referrer);
 
-  net::HttpRequestHeaders headers;
-  headers.AddHeadersFromString(request.headers);
-  url_request_->SetExtraRequestHeaders(headers);
+  url_request_->SetExtraRequestHeaders(request.headers);
 
   // Resolve elements from request_body and prepare upload data.
   if (request.request_body.get()) {

diff --git a/content/public/app/mojo/content_renderer_manifest.json b/content/public/app/mojo/content_renderer_manifest.json
index e50386b..cfb7f9e9 100644
--- a/content/public/app/mojo/content_renderer_manifest.json
+++ b/content/public/app/mojo/content_renderer_manifest.json

@@ -10,6 +10,7 @@
           "content::mojom::EmbeddedWorkerSetup",
           "content::mojom::FrameFactory",
           "content::mojom::RenderWidgetWindowTreeClientFactory",
+          "content::mojom::WebDatabase",
           "IPC::mojom::ChannelBootstrap",
           "visitedlink::mojom::VisitedLinkNotificationSink",
           "web_cache::mojom::WebCache"

diff --git a/content/public/browser/download_manager.cc b/content/public/browser/download_manager.cc
index c303d7a..537f6964 100644
--- a/content/public/browser/download_manager.cc
+++ b/content/public/browser/download_manager.cc

@@ -4,6 +4,7 @@
 
 #include "content/public/browser/download_manager.h"
 
+#include "content/browser/byte_stream.h"
 #include "content/browser/download/download_task_runner.h"
 
 namespace content {
@@ -13,4 +14,18 @@
   return GetDownloadTaskRunner();
 }
 
+DownloadManager::InputStream::InputStream(
+    std::unique_ptr<ByteStreamReader> stream_reader)
+    : stream_reader_(std::move(stream_reader)) {}
+
+DownloadManager::InputStream::InputStream(
+    mojom::DownloadStreamHandlePtr stream_handle)
+    : stream_handle_(std::move(stream_handle)) {}
+
+DownloadManager::InputStream::~InputStream() = default;
+
+bool DownloadManager::InputStream::IsEmpty() const {
+  return !stream_reader_.get() && stream_handle_.is_null();
+}
+
 }  // namespace content

diff --git a/content/public/browser/download_manager.h b/content/public/browser/download_manager.h
index 8a23802..2f625b2 100644
--- a/content/public/browser/download_manager.h
+++ b/content/public/browser/download_manager.h

@@ -39,6 +39,8 @@
 #include "content/public/browser/download_interrupt_reasons.h"
 #include "content/public/browser/download_item.h"
 #include "content/public/browser/download_url_parameters.h"
+#include "content/public/common/download_stream.mojom.h"
+#include "content/public/common/url_loader.mojom.h"
 #include "net/base/net_errors.h"
 
 class GURL;
@@ -101,13 +103,26 @@
   // clearing |downloads| first.
   virtual void GetAllDownloads(DownloadVector* downloads) = 0;
 
+  // InputStream to read after the download starts. Only one of them could be
+  // available at the same time.
+  struct CONTENT_EXPORT InputStream {
+    explicit InputStream(std::unique_ptr<ByteStreamReader> stream_reader);
+    explicit InputStream(mojom::DownloadStreamHandlePtr stream_handle);
+    ~InputStream();
+
+    bool IsEmpty() const;
+
+    std::unique_ptr<ByteStreamReader> stream_reader_;
+    mojom::DownloadStreamHandlePtr stream_handle_;
+  };
+
   // Called by a download source (Currently DownloadResourceHandler)
   // to initiate the non-source portions of a download.
   // Returns the id assigned to the download.  If the DownloadCreateInfo
   // specifies an id, that id will be used.
   virtual void StartDownload(
       std::unique_ptr<DownloadCreateInfo> info,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<InputStream> stream,
       const DownloadUrlParameters::OnStartedCallback& on_started) = 0;
 
   // Remove downloads whose URLs match the |url_filter| and are within

diff --git a/content/public/browser/touch_selection_controller_client_manager.h b/content/public/browser/touch_selection_controller_client_manager.h
index 7b62d91..01460afe 100644
--- a/content/public/browser/touch_selection_controller_client_manager.h
+++ b/content/public/browser/touch_selection_controller_client_manager.h

@@ -26,6 +26,8 @@
  public:
   virtual ~TouchSelectionControllerClientManager() {}
 
+  virtual void DidStopFlinging() = 0;
+
   // The manager uses this class' methods to notify observers about important
   // events.
   class CONTENT_EXPORT Observer {

diff --git a/content/public/browser/web_contents_view_delegate.cc b/content/public/browser/web_contents_view_delegate.cc
index caf45ddd..cc4f8ce63 100644
--- a/content/public/browser/web_contents_view_delegate.cc
+++ b/content/public/browser/web_contents_view_delegate.cc

@@ -44,7 +44,8 @@
     gfx::ColorSpace* color_space) {}
 
 void* WebContentsViewDelegate::CreateRenderWidgetHostViewDelegate(
-    RenderWidgetHost* render_widget_host) {
+    RenderWidgetHost* render_widget_host,
+    bool is_popup) {
   return nullptr;
 }
 

diff --git a/content/public/browser/web_contents_view_delegate.h b/content/public/browser/web_contents_view_delegate.h
index f9168bb..21bf273e 100644
--- a/content/public/browser/web_contents_view_delegate.h
+++ b/content/public/browser/web_contents_view_delegate.h

@@ -63,11 +63,12 @@
   // events on the responder chain.
 #if defined(__OBJC__)
   virtual NSObject<RenderWidgetHostViewMacDelegate>*
-      CreateRenderWidgetHostViewDelegate(
-          RenderWidgetHost* render_widget_host);
+  CreateRenderWidgetHostViewDelegate(RenderWidgetHost* render_widget_host,
+                                     bool is_popup);
 #else
   virtual void* CreateRenderWidgetHostViewDelegate(
-      RenderWidgetHost* render_widget_host);
+      RenderWidgetHost* render_widget_host,
+      bool is_popup);
 #endif
 };
 

diff --git a/content/public/common/BUILD.gn b/content/public/common/BUILD.gn
index ac65a7e..aae4c54c8 100644
--- a/content/public/common/BUILD.gn
+++ b/content/public/common/BUILD.gn

@@ -245,6 +245,7 @@
     "url_constants.cc",
     "url_constants.h",
     "url_fetcher.h",
+    "url_loader_throttle.cc",
     "url_loader_throttle.h",
     "url_utils.cc",
     "url_utils.h",
@@ -357,6 +358,7 @@
 
   sources = [
     "cookie_manager.mojom",
+    "download_stream.mojom",
     "mutable_network_traffic_annotation_tag.mojom",
     "network_service.mojom",
     "network_service_test.mojom",

diff --git a/content/public/common/common_param_traits.cc b/content/public/common/common_param_traits.cc
index 2a990c4..281c1c2 100644
--- a/content/public/common/common_param_traits.cc
+++ b/content/public/common/common_param_traits.cc

@@ -13,6 +13,8 @@
 #include "net/base/host_port_pair.h"
 #include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_util.h"
 
 namespace IPC {
 
@@ -94,6 +96,43 @@
   l->append(p.ToString());
 }
 
+void ParamTraits<net::HttpRequestHeaders>::GetSize(base::PickleSizer* s,
+                                                   const param_type& p) {
+  GetParamSize(s, static_cast<int>(p.GetHeaderVector().size()));
+  for (size_t i = 0; i < p.GetHeaderVector().size(); ++i)
+    GetParamSize(s, p.GetHeaderVector()[i]);
+}
+
+void ParamTraits<net::HttpRequestHeaders>::Write(base::Pickle* m,
+                                                 const param_type& p) {
+  WriteParam(m, static_cast<int>(p.GetHeaderVector().size()));
+  for (size_t i = 0; i < p.GetHeaderVector().size(); ++i)
+    WriteParam(m, p.GetHeaderVector()[i]);
+}
+
+bool ParamTraits<net::HttpRequestHeaders>::Read(const base::Pickle* m,
+                                                base::PickleIterator* iter,
+                                                param_type* r) {
+  // Sanity check.
+  int size;
+  if (!iter->ReadLength(&size))
+    return false;
+  for (int i = 0; i < size; ++i) {
+    net::HttpRequestHeaders::HeaderKeyValuePair pair;
+    if (!ReadParam(m, iter, &pair) ||
+        !net::HttpUtil::IsValidHeaderName(pair.key) ||
+        !net::HttpUtil::IsValidHeaderValue(pair.value))
+      return false;
+    r->SetHeader(pair.key, pair.value);
+  }
+  return true;
+}
+
+void ParamTraits<net::HttpRequestHeaders>::Log(const param_type& p,
+                                               std::string* l) {
+  l->append(p.ToString());
+}
+
 void ParamTraits<net::IPEndPoint>::GetSize(base::PickleSizer* s,
                                            const param_type& p) {
   GetParamSize(s, p.address());

diff --git a/content/public/common/common_param_traits.h b/content/public/common/common_param_traits.h
index 8665995..3dcbcea7 100644
--- a/content/public/common/common_param_traits.h
+++ b/content/public/common/common_param_traits.h

@@ -38,6 +38,7 @@
 
 namespace net {
 class HostPortPair;
+class HttpRequestHeaders;
 class IPAddress;
 class IPEndPoint;
 }
@@ -67,6 +68,17 @@
 };
 
 template <>
+struct CONTENT_EXPORT ParamTraits<net::HttpRequestHeaders> {
+  typedef net::HttpRequestHeaders param_type;
+  static void GetSize(base::PickleSizer* s, const param_type& p);
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* r);
+  static void Log(const param_type& p, std::string* l);
+};
+
+template <>
 struct CONTENT_EXPORT ParamTraits<net::IPEndPoint> {
   typedef net::IPEndPoint param_type;
   static void GetSize(base::PickleSizer* s, const param_type& p);

diff --git a/content/public/common/common_param_traits_macros.h b/content/public/common/common_param_traits_macros.h
index f0df228..074c172 100644
--- a/content/public/common/common_param_traits_macros.h
+++ b/content/public/common/common_param_traits_macros.h

@@ -16,6 +16,7 @@
 #include "ipc/ipc_message_macros.h"
 #include "net/base/network_change_notifier.h"
 #include "net/base/request_priority.h"
+#include "net/http/http_request_headers.h"
 #include "net/nqe/effective_connection_type.h"
 #include "third_party/WebKit/public/platform/WebPoint.h"
 #include "third_party/WebKit/public/platform/WebRect.h"
@@ -290,4 +291,9 @@
   IPC_STRUCT_TRAITS_MEMBER(transform)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(net::HttpRequestHeaders::HeaderKeyValuePair)
+  IPC_STRUCT_TRAITS_MEMBER(key)
+  IPC_STRUCT_TRAITS_MEMBER(value)
+IPC_STRUCT_TRAITS_END()
+
 #endif  // CONTENT_PUBLIC_COMMON_COMMON_PARAM_TRAITS_MACROS_H_

diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 317c44c..f7cdb1af 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc

@@ -267,6 +267,11 @@
 const base::Feature kSignInProcessIsolation{"sign-in-process-isolation",
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Alternative to switches::kSitePerProcess, for turning on full site isolation.
+// Launch bug: https://crbug.com/739418.
+const base::Feature kSitePerProcess{"site-per-process",
+                                    base::FEATURE_DISABLED_BY_DEFAULT};
+
 // An experiment for skipping compositing small scrollers.
 const base::Feature kSkipCompositingSmallScrollers{
     "SkipCompositingSmallScrollers", base::FEATURE_DISABLED_BY_DEFAULT};

diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index fad909a..aae96213 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h

@@ -73,6 +73,7 @@
 CONTENT_EXPORT extern const base::Feature kServiceWorkerScriptStreaming;
 CONTENT_EXPORT extern const base::Feature kSharedArrayBuffer;
 CONTENT_EXPORT extern const base::Feature kSignInProcessIsolation;
+CONTENT_EXPORT extern const base::Feature kSitePerProcess;
 CONTENT_EXPORT extern const base::Feature kSkipCompositingSmallScrollers;
 CONTENT_EXPORT extern const base::Feature kSlimmingPaintInvalidation;
 CONTENT_EXPORT extern const base::Feature kTimerThrottlingForHiddenFrames;

diff --git a/content/public/common/download_stream.mojom b/content/public/common/download_stream.mojom
new file mode 100644
index 0000000..f18cc47
--- /dev/null
+++ b/content/public/common/download_stream.mojom

@@ -0,0 +1,28 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+enum NetworkRequestStatus {
+  OK,
+  NETWORK_TIMEOUT,
+  NETWORK_DISCONNECTED,
+  NETWORK_SERVER_DOWN,
+  SERVER_NO_RANGE,
+  SERVER_CONTENT_LENGTH_MISMATCH,
+  SERVER_UNREACHABLE,
+  SERVER_CERT_PROBLEM,
+  USER_CANCELED,
+  NETWORK_FAILED,
+};
+
+// Used to pass the interruption status to the consumer of the data pipe.
+interface DownloadStreamClient {
+  OnStreamCompleted(NetworkRequestStatus status);
+};
+
+struct DownloadStreamHandle {
+  handle<data_pipe_consumer> stream;
+  DownloadStreamClient& client_request;
+};
\ No newline at end of file

diff --git a/content/public/common/resource_request.h b/content/public/common/resource_request.h
index f776dfc..f5fb4e3 100644
--- a/content/public/common/resource_request.h
+++ b/content/public/common/resource_request.h

@@ -18,6 +18,7 @@
 #include "content/public/common/resource_type.h"
 #include "content/public/common/service_worker_modes.h"
 #include "net/base/request_priority.h"
+#include "net/http/http_request_headers.h"
 #include "third_party/WebKit/public/platform/WebMixedContentContextType.h"
 #include "third_party/WebKit/public/platform/WebPageVisibilityState.h"
 #include "third_party/WebKit/public/platform/WebReferrerPolicy.h"
@@ -61,12 +62,7 @@
       blink::kWebPageVisibilityStateVisible;
 
   // Additional HTTP request headers.
-  //
-  // For HTTP(S) requests, the headers parameter can be a \r\n-delimited and
-  // \r\n-terminated list of MIME headers.  They should be ASCII-encoded using
-  // the standard MIME header encoding rules.  The headers parameter can also
-  // be null if no extra request headers need to be set.
-  std::string headers;
+  net::HttpRequestHeaders headers;
 
   // net::URLRequest load flags (0 by default).
   int load_flags = 0;

diff --git a/content/public/common/simple_url_loader_unittest.cc b/content/public/common/simple_url_loader_unittest.cc
index 6e43aad4..00460a9 100644
--- a/content/public/common/simple_url_loader_unittest.cc
+++ b/content/public/common/simple_url_loader_unittest.cc

@@ -239,7 +239,7 @@
   // Use a more interesting request than "/echo", just to verify more than the
   // request URL is hooked up.
   resource_request.url = test_server_.GetURL("/echoheader?foo");
-  resource_request.headers = "foo: Expected Response";
+  resource_request.headers.SetHeader("foo", "Expected Response");
   WaitForStringHelper string_helper;
   string_helper.RunRequest(url_loader_factory_.get(), resource_request);
 

diff --git a/content/public/common/url_loader_throttle.cc b/content/public/common/url_loader_throttle.cc
new file mode 100644
index 0000000..9fee840
--- /dev/null
+++ b/content/public/common/url_loader_throttle.cc

@@ -0,0 +1,30 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/url_loader_throttle.h"
+
+#include "base/logging.h"
+
+namespace content {
+
+URLLoaderThrottle::Delegate::~Delegate() {}
+
+URLLoaderThrottle::~URLLoaderThrottle() {}
+
+void URLLoaderThrottle::DetachFromCurrentSequence() {
+  NOTREACHED();
+}
+
+void URLLoaderThrottle::WillStartRequest(const ResourceRequest& request,
+                                         bool* defer) {}
+
+void URLLoaderThrottle::WillRedirectRequest(
+    const net::RedirectInfo& redirect_info,
+    bool* defer) {}
+
+void URLLoaderThrottle::WillProcessResponse(bool* defer) {}
+
+URLLoaderThrottle::URLLoaderThrottle() {}
+
+}  // namespace content

diff --git a/content/public/common/url_loader_throttle.h b/content/public/common/url_loader_throttle.h
index a358263f..99e47bc 100644
--- a/content/public/common/url_loader_throttle.h
+++ b/content/public/common/url_loader_throttle.h

@@ -33,28 +33,33 @@
     virtual void Resume() = 0;
 
    protected:
-    virtual ~Delegate() {}
+    virtual ~Delegate();
   };
 
-  virtual ~URLLoaderThrottle() {}
+  virtual ~URLLoaderThrottle();
+
+  // Detaches this object from the current sequence in preparation for a move to
+  // a different sequence. If this method is called it must be before any of the
+  // Will* methods below and may only be called once.
+  virtual void DetachFromCurrentSequence();
 
   // Called before the resource request is started.
-  virtual void WillStartRequest(const ResourceRequest& request, bool* defer) {}
+  virtual void WillStartRequest(const ResourceRequest& request, bool* defer);
 
   // Called when the request was redirected.  |redirect_info| contains the
   // redirect responses's HTTP status code and some information about the new
   // request that will be sent if the redirect is followed, including the new
   // URL and new method.
   virtual void WillRedirectRequest(const net::RedirectInfo& redirect_info,
-                                   bool* defer) {}
+                                   bool* defer);
 
   // Called when the response headers and meta data are available.
-  virtual void WillProcessResponse(bool* defer) {}
+  virtual void WillProcessResponse(bool* defer);
 
   void set_delegate(Delegate* delegate) { delegate_ = delegate; }
 
  protected:
-  URLLoaderThrottle() = default;
+  URLLoaderThrottle();
 
   Delegate* delegate_ = nullptr;
 };

diff --git a/content/public/test/mock_download_manager.cc b/content/public/test/mock_download_manager.cc
index d2ec140..495cad2 100644
--- a/content/public/test/mock_download_manager.cc
+++ b/content/public/test/mock_download_manager.cc

@@ -110,7 +110,7 @@
 
 void MockDownloadManager::StartDownload(
     std::unique_ptr<DownloadCreateInfo> info,
-    std::unique_ptr<ByteStreamReader> stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const DownloadUrlParameters::OnStartedCallback& callback) {
   MockStartDownload(info.get(), stream.get());
 }

diff --git a/content/public/test/mock_download_manager.h b/content/public/test/mock_download_manager.h
index f462fa1..c3001ee 100644
--- a/content/public/test/mock_download_manager.h
+++ b/content/public/test/mock_download_manager.h

@@ -102,11 +102,11 @@
   // Gasket for handling scoped_ptr arguments.
   void StartDownload(
       std::unique_ptr<DownloadCreateInfo> info,
-      std::unique_ptr<ByteStreamReader> stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const DownloadUrlParameters::OnStartedCallback& callback) override;
 
   MOCK_METHOD2(MockStartDownload,
-               void(DownloadCreateInfo*, ByteStreamReader*));
+               void(DownloadCreateInfo*, DownloadManager::InputStream*));
   MOCK_METHOD3(RemoveDownloadsByURLAndTime,
                int(const base::Callback<bool(const GURL&)>& url_filter,
                    base::Time remove_begin,

diff --git a/content/public/test/test_file_error_injector.cc b/content/public/test/test_file_error_injector.cc
index a8a1f8f..207bc244 100644
--- a/content/public/test/test_file_error_injector.cc
+++ b/content/public/test/test_file_error_injector.cc

@@ -31,15 +31,14 @@
 // A class that performs file operations and injects errors.
 class DownloadFileWithError: public DownloadFileImpl {
  public:
-  DownloadFileWithError(
-      std::unique_ptr<DownloadSaveInfo> save_info,
-      const base::FilePath& default_download_directory,
-      std::unique_ptr<ByteStreamReader> byte_stream,
-      const net::NetLogWithSource& net_log,
-      base::WeakPtr<DownloadDestinationObserver> observer,
-      const TestFileErrorInjector::FileErrorInfo& error_info,
-      const base::Closure& ctor_callback,
-      const base::Closure& dtor_callback);
+  DownloadFileWithError(std::unique_ptr<DownloadSaveInfo> save_info,
+                        const base::FilePath& default_download_directory,
+                        std::unique_ptr<DownloadManager::InputStream> stream,
+                        const net::NetLogWithSource& net_log,
+                        base::WeakPtr<DownloadDestinationObserver> observer,
+                        const TestFileErrorInjector::FileErrorInfo& error_info,
+                        const base::Closure& ctor_callback,
+                        const base::Closure& dtor_callback);
 
   ~DownloadFileWithError() override;
 
@@ -108,7 +107,7 @@
 DownloadFileWithError::DownloadFileWithError(
     std::unique_ptr<DownloadSaveInfo> save_info,
     const base::FilePath& default_download_directory,
-    std::unique_ptr<ByteStreamReader> byte_stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const net::NetLogWithSource& net_log,
     base::WeakPtr<DownloadDestinationObserver> observer,
     const TestFileErrorInjector::FileErrorInfo& error_info,
@@ -116,7 +115,7 @@
     const base::Closure& dtor_callback)
     : DownloadFileImpl(std::move(save_info),
                        default_download_directory,
-                       std::move(byte_stream),
+                       std::move(stream),
                        net_log,
                        observer),
       error_info_(error_info),
@@ -268,7 +267,7 @@
   DownloadFile* CreateFile(
       std::unique_ptr<DownloadSaveInfo> save_info,
       const base::FilePath& default_download_directory,
-      std::unique_ptr<ByteStreamReader> byte_stream,
+      std::unique_ptr<DownloadManager::InputStream> stream,
       const net::NetLogWithSource& net_log,
       base::WeakPtr<DownloadDestinationObserver> observer) override;
 
@@ -298,11 +297,11 @@
 DownloadFile* DownloadFileWithErrorFactory::CreateFile(
     std::unique_ptr<DownloadSaveInfo> save_info,
     const base::FilePath& default_download_directory,
-    std::unique_ptr<ByteStreamReader> byte_stream,
+    std::unique_ptr<DownloadManager::InputStream> stream,
     const net::NetLogWithSource& net_log,
     base::WeakPtr<DownloadDestinationObserver> observer) {
   return new DownloadFileWithError(
-      std::move(save_info), default_download_directory, std::move(byte_stream),
+      std::move(save_info), default_download_directory, std::move(stream),
       net_log, observer, injected_error_, construction_callback_,
       destruction_callback_);
 }

diff --git a/content/renderer/accessibility/render_accessibility_impl.cc b/content/renderer/accessibility/render_accessibility_impl.cc
index aed4c7d..02ccb1a3 100644
--- a/content/renderer/accessibility/render_accessibility_impl.cc
+++ b/content/renderer/accessibility/render_accessibility_impl.cc

@@ -518,13 +518,13 @@
 
   switch (data.action) {
     case ui::AX_ACTION_BLUR:
-      root.Focus();
+      target.SetFocused(false);
       break;
     case ui::AX_ACTION_DECREMENT:
       target.Decrement();
       break;
     case ui::AX_ACTION_DO_DEFAULT:
-      target.Click();
+      target.PerformDefaultAction();
       break;
     case ui::AX_ACTION_GET_IMAGE_DATA:
       OnGetImageData(target, data.target_rect.size());
@@ -549,7 +549,12 @@
       OnLoadInlineTextBoxes(target);
       break;
     case ui::AX_ACTION_FOCUS:
-      target.Focus();
+      // By convention, calling SetFocus on the root of the tree should
+      // clear the current focus. Otherwise set the focus to the new node.
+      if (data.target_node_id == root.AxID())
+        render_frame_->GetRenderView()->GetWebView()->ClearFocusedElement();
+      else
+        target.SetFocused(true);
       break;
     case ui::AX_ACTION_SET_SCROLL_OFFSET:
       target.SetScrollOffset(

diff --git a/content/renderer/browser_plugin/browser_plugin.cc b/content/renderer/browser_plugin/browser_plugin.cc
index b779cc08..b9c91d0f3 100644
--- a/content/renderer/browser_plugin/browser_plugin.cc
+++ b/content/renderer/browser_plugin/browser_plugin.cc

@@ -18,6 +18,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/viz/common/surfaces/surface_info.h"
+#include "components/viz/common/switches.h"
 #include "content/common/browser_plugin/browser_plugin_constants.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/view_messages.h"
@@ -52,10 +53,17 @@
 using blink::WebVector;
 
 namespace {
+
 using PluginContainerMap =
     std::map<blink::WebPluginContainer*, content::BrowserPlugin*>;
 static base::LazyInstance<PluginContainerMap>::DestructorAtExit
     g_plugin_container_map = LAZY_INSTANCE_INITIALIZER;
+
+bool IsRunningInMash() {
+  const base::CommandLine* cmdline = base::CommandLine::ForCurrentProcess();
+  return cmdline->HasSwitch(switches::kIsRunningInMash);
+}
+
 }  // namespace
 
 namespace content {
@@ -90,12 +98,18 @@
 
   if (delegate_)
     delegate_->SetElementInstanceID(browser_plugin_instance_id_);
+
+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  enable_surface_synchronization_ =
+      IsRunningInMash() ||
+      command_line.HasSwitch(switches::kEnableSurfaceSynchronization);
 }
 
 BrowserPlugin::~BrowserPlugin() {
   Detach();
 
-  if (compositing_helper_.get())
+  if (compositing_helper_)
     compositing_helper_->OnContainerDestroy();
 
   if (delegate_) {
@@ -130,9 +144,28 @@
   if (!attached())
     return;
 
-  EnableCompositing(true);
-  DCHECK(compositing_helper_.get());
-  compositing_helper_->SetPrimarySurfaceInfo(surface_info);
+  if (!compositing_helper_) {
+    compositing_helper_.reset(
+        ChildFrameCompositingHelper::CreateForBrowserPlugin(
+            weak_ptr_factory_.GetWeakPtr()));
+    if (enable_surface_synchronization_) {
+      // We wait until there is a single CompositorFrame guaranteed to be
+      // available and ready for display in the display compositor before using
+      // surface synchronization. This guarantees that we will have something to
+      // display when the compositor goes to produce a display frame.
+      //
+      // Once there's an available fallback surface that can be employed, then
+      // the primary surface is updated as soon as the frame rect changes.
+      //
+      // The compositor will attempt to composite the primary surface within a
+      // give deadline (4 frames is the default). If the primary surface isn't
+      // available for four frames, then the fallback surface will be used.
+      compositing_helper_->SetPrimarySurfaceInfo(surface_info);
+    }
+  }
+
+  if (!enable_surface_synchronization_)
+    compositing_helper_->SetPrimarySurfaceInfo(surface_info);
   compositing_helper_->SetFallbackSurfaceInfo(surface_info, sequence);
 }
 
@@ -188,6 +221,8 @@
           ui::AX_EVENT_CHILDREN_CHANGED);
     }
   }
+
+  ViewRectsChanged(view_rect());
 }
 
 void BrowserPlugin::Detach() {
@@ -196,7 +231,10 @@
 
   attached_ = false;
   guest_crashed_ = false;
-  EnableCompositing(false);
+  if (compositing_helper_) {
+    compositing_helper_->OnContainerDestroy();
+    compositing_helper_.reset();
+  }
 
   BrowserPluginManager::Get()->Send(
       new BrowserPluginHostMsg_Detach(browser_plugin_instance_id_));
@@ -218,12 +256,22 @@
 void BrowserPlugin::OnGuestGone(int browser_plugin_instance_id) {
   guest_crashed_ = true;
 
-  EnableCompositing(true);
+  if (!compositing_helper_) {
+    compositing_helper_.reset(
+        ChildFrameCompositingHelper::CreateForBrowserPlugin(
+            weak_ptr_factory_.GetWeakPtr()));
+  }
   compositing_helper_->ChildFrameGone();
 }
 
-void BrowserPlugin::OnGuestReady(int browser_plugin_instance_id) {
+void BrowserPlugin::OnGuestReady(int browser_plugin_instance_id,
+                                 const viz::FrameSinkId& frame_sink_id) {
   guest_crashed_ = false;
+  frame_sink_id_ = frame_sink_id;
+  gfx::Rect view_rect = view_rect_;
+  view_rect_ = gfx::Rect();
+  if (!view_rect.IsEmpty())
+    ViewRectsChanged(view_rect);
 }
 
 void BrowserPlugin::OnSetCursor(int browser_plugin_instance_id,
@@ -277,6 +325,37 @@
       base::UTF8ToUTF16(base::IntToString(browser_plugin_instance_id_)));
 }
 
+void BrowserPlugin::ViewRectsChanged(const gfx::Rect& view_rect) {
+  bool rect_size_changed = view_rect_.size() != view_rect.size();
+  if (rect_size_changed || !local_surface_id_.is_valid()) {
+    local_surface_id_ = local_surface_id_allocator_.GenerateId();
+    if (compositing_helper_ && enable_surface_synchronization_ &&
+        frame_sink_id_.is_valid()) {
+      RenderWidget* render_widget =
+          RenderFrameImpl::FromWebFrame(Container()->GetDocument().GetFrame())
+              ->GetRenderWidget();
+      float device_scale_factor = render_widget->GetOriginalDeviceScaleFactor();
+      viz::SurfaceInfo surface_info(
+          viz::SurfaceId(frame_sink_id_, local_surface_id_),
+          device_scale_factor,
+          gfx::ScaleToCeiledSize(view_rect_.size(), device_scale_factor));
+      compositing_helper_->SetPrimarySurfaceInfo(surface_info);
+    }
+  }
+
+  view_rect_ = view_rect;
+
+  if (!attached())
+    return;
+
+  // Let the browser know about the updated view rect.
+  BrowserPluginManager::Get()->Send(new BrowserPluginHostMsg_UpdateGeometry(
+      browser_plugin_instance_id_, view_rect_, local_surface_id_));
+
+  if (rect_size_changed && delegate_)
+    delegate_->DidResizeElement(view_rect_.size());
+}
+
 void BrowserPlugin::UpdateGuestFocusState(blink::WebFocusType focus_type) {
   if (!attached())
     return;
@@ -322,26 +401,6 @@
   return true;
 }
 
-void BrowserPlugin::EnableCompositing(bool enable) {
-  bool enabled = !!compositing_helper_.get();
-  if (enabled == enable)
-    return;
-
-  if (enable) {
-    DCHECK(!compositing_helper_.get());
-    if (!compositing_helper_.get()) {
-      compositing_helper_ = ChildFrameCompositingHelper::CreateForBrowserPlugin(
-          weak_ptr_factory_.GetWeakPtr());
-    }
-  }
-
-  if (!enable) {
-    DCHECK(compositing_helper_.get());
-    compositing_helper_->OnContainerDestroy();
-    compositing_helper_ = nullptr;
-  }
-}
-
 void BrowserPlugin::Destroy() {
   if (container_) {
     // The BrowserPlugin's WebPluginContainer is deleted immediately after this
@@ -393,17 +452,17 @@
                                    const WebRect& clip_rect,
                                    const WebRect& unobscured_rect,
                                    bool is_visible) {
-  gfx::Rect old_view_rect = view_rect_;
   // Convert the plugin_rect_in_viewport to window coordinates, which is css.
   WebRect rect_in_css(plugin_rect_in_viewport);
 
   // We will use the local root's RenderWidget to convert coordinates to Window.
   // If this local root belongs to an OOPIF, on the browser side we will have to
   // consider the displacement of the child frame in root window.
-  RenderFrameImpl::FromWebFrame(Container()->GetDocument().GetFrame())
-      ->GetRenderWidget()
-      ->ConvertViewportToWindow(&rect_in_css);
-  view_rect_ = rect_in_css;
+  RenderWidget* render_widget =
+      RenderFrameImpl::FromWebFrame(Container()->GetDocument().GetFrame())
+          ->GetRenderWidget();
+  render_widget->ConvertViewportToWindow(&rect_in_css);
+  gfx::Rect view_rect = rect_in_css;
 
   if (!ready_) {
     if (delegate_)
@@ -411,20 +470,7 @@
     ready_ = true;
   }
 
-  bool rect_size_changed = view_rect_.size() != old_view_rect.size();
-  if (delegate_ && rect_size_changed)
-    delegate_->DidResizeElement(view_rect_.size());
-
-  if (!attached())
-    return;
-
-  if ((!delegate_ && rect_size_changed) ||
-      view_rect_.origin() != old_view_rect.origin()) {
-    // Let the browser know about the updated view rect.
-    BrowserPluginManager::Get()->Send(new BrowserPluginHostMsg_UpdateGeometry(
-        browser_plugin_instance_id_, view_rect_));
-    return;
-  }
+  ViewRectsChanged(view_rect);
 }
 
 void BrowserPlugin::UpdateFocus(bool focused, blink::WebFocusType focus_type) {
@@ -440,7 +486,7 @@
   if (!attached())
     return;
 
-  if (compositing_helper_.get())
+  if (compositing_helper_)
     compositing_helper_->UpdateVisibility(visible);
 
   BrowserPluginManager::Get()->Send(new BrowserPluginHostMsg_SetVisibility(

diff --git a/content/renderer/browser_plugin/browser_plugin.h b/content/renderer/browser_plugin/browser_plugin.h
index f0cd261..2b23b0c 100644
--- a/content/renderer/browser_plugin/browser_plugin.h
+++ b/content/renderer/browser_plugin/browser_plugin.h

@@ -12,6 +12,9 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/sequenced_task_runner_helpers.h"
+#include "components/viz/common/surfaces/frame_sink_id.h"
+#include "components/viz/common/surfaces/local_surface_id.h"
+#include "components/viz/common/surfaces/local_surface_id_allocator.h"
 #include "content/renderer/mouse_lock_dispatcher.h"
 #include "content/renderer/render_view_impl.h"
 #include "third_party/WebKit/public/web/WebDragStatus.h"
@@ -55,9 +58,6 @@
   // Indicates whether the guest should be focused.
   bool ShouldGuestBeFocused() const;
 
-  // A request to enable hardware compositing.
-  void EnableCompositing(bool enable);
-
   // Called by CompositingHelper to send current SurfaceSequence to browser.
   void SendSatisfySequence(const viz::SurfaceSequence& sequence);
 
@@ -149,11 +149,13 @@
 
   void UpdateInternalInstanceId();
 
+  void ViewRectsChanged(const gfx::Rect& view_rect);
+
   // IPC message handlers.
   // Please keep in alphabetical order.
   void OnAdvanceFocus(int instance_id, bool reverse);
   void OnGuestGone(int instance_id);
-  void OnGuestReady(int instance_id);
+  void OnGuestReady(int instance_id, const viz::FrameSinkId& frame_sink_id);
   void OnSetChildFrameSurface(int instance_id,
                               const viz::SurfaceInfo& surface_info,
                               const viz::SurfaceSequence& sequence);
@@ -188,13 +190,18 @@
   bool ready_;
 
   // Used for HW compositing.
-  scoped_refptr<ChildFrameCompositingHelper> compositing_helper_;
+  std::unique_ptr<ChildFrameCompositingHelper> compositing_helper_;
 
   // URL for the embedder frame.
   int browser_plugin_instance_id_;
 
   std::vector<EditCommand> edit_commands_;
 
+  viz::FrameSinkId frame_sink_id_;
+  viz::LocalSurfaceId local_surface_id_;
+  viz::LocalSurfaceIdAllocator local_surface_id_allocator_;
+
+  bool enable_surface_synchronization_ = false;
   // We call lifetime managing methods on |delegate_|, but we do not directly
   // own this. The delegate destroys itself.
   base::WeakPtr<BrowserPluginDelegate> delegate_;

diff --git a/content/renderer/child_frame_compositing_helper.h b/content/renderer/child_frame_compositing_helper.h
index 31c9d3d6..77e17f0 100644
--- a/content/renderer/child_frame_compositing_helper.h
+++ b/content/renderer/child_frame_compositing_helper.h

@@ -12,7 +12,6 @@
 #include <vector>
 
 #include "base/macros.h"
-#include "base/memory/ref_counted.h"
 #include "base/memory/shared_memory.h"
 #include "base/memory/weak_ptr.h"
 #include "cc/layers/surface_layer.h"
@@ -46,9 +45,10 @@
 class BrowserPlugin;
 class RenderFrameProxy;
 
-class CONTENT_EXPORT ChildFrameCompositingHelper
-    : public base::RefCounted<ChildFrameCompositingHelper> {
+class CONTENT_EXPORT ChildFrameCompositingHelper {
  public:
+  virtual ~ChildFrameCompositingHelper();
+
   static ChildFrameCompositingHelper* CreateForBrowserPlugin(
       const base::WeakPtr<BrowserPlugin>& browser_plugin);
   static ChildFrameCompositingHelper* CreateForRenderFrameProxy(
@@ -74,8 +74,6 @@
       RenderFrameProxy* render_frame_proxy,
       int host_routing_id);
 
-  virtual ~ChildFrameCompositingHelper();
-
   blink::WebPluginContainer* GetContainer();
 
   void CheckSizeAndAdjustLayerProperties(const viz::SurfaceInfo& surface_info,

diff --git a/content/renderer/fetchers/resource_fetcher_impl.cc b/content/renderer/fetchers/resource_fetcher_impl.cc
index 9e19b19..29c1899 100644
--- a/content/renderer/fetchers/resource_fetcher_impl.cc
+++ b/content/renderer/fetchers/resource_fetcher_impl.cc

@@ -279,7 +279,7 @@
     DCHECK(request_.referrer.is_valid());
     request_.referrer_policy = blink::kWebReferrerPolicyDefault;
   } else {
-    headers_.SetHeader(header, value);
+    request_.headers.SetHeader(header, value);
   }
 }
 
@@ -344,9 +344,6 @@
     SetHeader(kAccessControlAllowOriginHeader,
               blink::WebSecurityOrigin::CreateUnique().ToString().Ascii());
   }
-  if (!headers_.IsEmpty())
-    request_.headers = headers_.ToString();
-
   request_.resource_type = WebURLRequestContextToResourceType(request_context);
 
   client_ = base::MakeUnique<ClientImpl>(this, callback, maximum_download_size);

diff --git a/content/renderer/fetchers/resource_fetcher_impl.h b/content/renderer/fetchers/resource_fetcher_impl.h
index ec91621..74a8cef 100644
--- a/content/renderer/fetchers/resource_fetcher_impl.h
+++ b/content/renderer/fetchers/resource_fetcher_impl.h

@@ -60,11 +60,6 @@
   // Request to send.
   ResourceRequest request_;
 
-  // HTTP headers to build a header string for |request_|.
-  // TODO(toyoshim): Remove this member once ResourceRequest uses
-  // net::HttpRequestHeaders instead of std::string for headers.
-  net::HttpRequestHeaders headers_;
-
   // Limit how long to wait for the server.
   base::OneShotTimer timeout_timer_;
 

diff --git a/content/renderer/media/audio_input_message_filter.cc b/content/renderer/media/audio_input_message_filter.cc
index 527621c..a67f165 100644
--- a/content/renderer/media/audio_input_message_filter.cc
+++ b/content/renderer/media/audio_input_message_filter.cc

@@ -126,8 +126,6 @@
     int stream_id,
     base::SharedMemoryHandle handle,
     base::SyncSocket::TransitDescriptor socket_descriptor,
-    uint32_t length,
-    uint32_t total_segments,
     bool initially_muted) {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
   LogMessage(stream_id, "OnStreamCreated");
@@ -143,8 +141,7 @@
     return;
   }
   // Forward message to the stream delegate.
-  delegate->OnStreamCreated(handle, socket_handle, length, total_segments,
-                            initially_muted);
+  delegate->OnStreamCreated(handle, socket_handle, initially_muted);
 }
 
 void AudioInputMessageFilter::OnStreamError(int stream_id) {

diff --git a/content/renderer/media/audio_input_message_filter.h b/content/renderer/media/audio_input_message_filter.h
index dfa4f7f8..cec8f6f 100644
--- a/content/renderer/media/audio_input_message_filter.h
+++ b/content/renderer/media/audio_input_message_filter.h

@@ -72,8 +72,6 @@
 #else
                        base::FileDescriptor socket_descriptor,
 #endif
-                       uint32_t length,
-                       uint32_t total_segments,
                        bool initially_muted);
 
   // Received when internal state of browser process' audio input stream has

diff --git a/content/renderer/media/audio_ipc_factory_unittest.cc b/content/renderer/media/audio_ipc_factory_unittest.cc
index b8ed82d9..a99ae27 100644
--- a/content/renderer/media/audio_ipc_factory_unittest.cc
+++ b/content/renderer/media/audio_ipc_factory_unittest.cc

@@ -73,8 +73,7 @@
                           const media::AudioParameters& output_params,
                           const std::string& matched_device_id) override {}
   void OnStreamCreated(base::SharedMemoryHandle handle,
-                       base::SyncSocket::Handle socket_handle,
-                       int length) override {}
+                       base::SyncSocket::Handle socket_handle) override {}
   void OnIPCClosed() override {}
 };
 

diff --git a/content/renderer/media/audio_message_filter.cc b/content/renderer/media/audio_message_filter.cc
index c5a4ff2..abe24b04 100644
--- a/content/renderer/media/audio_message_filter.cc
+++ b/content/renderer/media/audio_message_filter.cc

@@ -4,8 +4,6 @@
 
 #include "content/renderer/media/audio_message_filter.h"
 
-#include <string>
-
 #include "base/bind.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/stringprintf.h"
@@ -199,8 +197,7 @@
 void AudioMessageFilter::OnStreamCreated(
     int stream_id,
     base::SharedMemoryHandle handle,
-    base::SyncSocket::TransitDescriptor socket_descriptor,
-    uint32_t length) {
+    base::SyncSocket::TransitDescriptor socket_descriptor) {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
 
   WebRtcLogMessage(base::StringPrintf(
@@ -218,7 +215,7 @@
     base::SyncSocket socket(socket_handle);
     return;
   }
-  delegate->OnStreamCreated(handle, socket_handle, length);
+  delegate->OnStreamCreated(handle, socket_handle);
 }
 
 void AudioMessageFilter::OnStreamError(int stream_id) {

diff --git a/content/renderer/media/audio_message_filter.h b/content/renderer/media/audio_message_filter.h
index 21b027ed..22a15ca4 100644
--- a/content/renderer/media/audio_message_filter.h
+++ b/content/renderer/media/audio_message_filter.h

@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include <memory>
+#include <string>
 
 #include "base/containers/id_map.h"
 #include "base/gtest_prod_util.h"
@@ -80,8 +81,7 @@
   // Received when browser process has created an audio output stream.
   void OnStreamCreated(int stream_id,
                        base::SharedMemoryHandle handle,
-                       base::SyncSocket::TransitDescriptor socket_descriptor,
-                       uint32_t length);
+                       base::SyncSocket::TransitDescriptor socket_descriptor);
 
   // Received when internal state of browser process' audio output device has
   // changed.

diff --git a/content/renderer/media/audio_message_filter_unittest.cc b/content/renderer/media/audio_message_filter_unittest.cc
index a4223f4..1950724 100644
--- a/content/renderer/media/audio_message_filter_unittest.cc
+++ b/content/renderer/media/audio_message_filter_unittest.cc

@@ -42,11 +42,9 @@
   }
 
   void OnStreamCreated(base::SharedMemoryHandle handle,
-                       base::SyncSocket::Handle,
-                       int length) override {
+                       base::SyncSocket::Handle) override {
     created_received_ = true;
     handle_ = handle;
-    length_ = length;
   }
 
   void OnIPCClosed() override {}
@@ -62,7 +60,6 @@
     if (handle_.IsValid())
       handle_.Close();
     handle_ = base::SharedMemoryHandle();
-    length_ = 0;
 
     volume_received_ = false;
     volume_ = 0;
@@ -76,7 +73,6 @@
 
   bool created_received() { return created_received_; }
   base::SharedMemoryHandle handle() { return handle_; }
-  uint32_t length() { return length_; }
 
  private:
   bool error_received_;
@@ -88,7 +84,6 @@
 
   bool created_received_;
   base::SharedMemoryHandle handle_;
-  int length_;
 
   bool volume_received_;
   double volume_;
@@ -134,13 +129,11 @@
 
   // AudioMsg_NotifyStreamCreated
   base::SyncSocket::TransitDescriptor socket_descriptor;
-  const uint32_t kLength = 1024;
   EXPECT_FALSE(delegate.created_received());
   filter->OnMessageReceived(AudioMsg_NotifyStreamCreated(
-      kStreamId, base::SharedMemoryHandle(), socket_descriptor, kLength));
+      kStreamId, base::SharedMemoryHandle(), socket_descriptor));
   EXPECT_TRUE(delegate.created_received());
   EXPECT_FALSE(base::SharedMemory::IsHandleValid(delegate.handle()));
-  EXPECT_EQ(kLength, delegate.length());
   delegate.Reset();
 
   // AudioMsg_NotifyStreamStateChanged

diff --git a/content/renderer/media/media_stream_dispatcher.cc b/content/renderer/media/media_stream_dispatcher.cc
index 3cfe54b6..39ec6a3 100644
--- a/content/renderer/media/media_stream_dispatcher.cc
+++ b/content/renderer/media/media_stream_dispatcher.cc

@@ -179,15 +179,20 @@
   GetMediaStreamDispatcherHost()->StreamStarted(label);
 }
 
-StreamDeviceInfoArray MediaStreamDispatcher::GetNonScreenCaptureDevices() {
-  StreamDeviceInfoArray video_array;
+MediaStreamDevices MediaStreamDispatcher::GetNonScreenCaptureDevices() {
+  MediaStreamDevices video_devices;
   for (const auto& stream_it : label_stream_map_) {
-    for (const auto& video_device : stream_it.second.video_array) {
-      if (!IsScreenCaptureMediaType(video_device.device.type))
-        video_array.push_back(video_device);
+    for (const auto& video_device_info : stream_it.second.video_array) {
+      if (!IsScreenCaptureMediaType(video_device_info.device.type)) {
+        // TODO(c.padhi): Remove this when |video_device_info|'s type is changed
+        // to MediaStreamDevice, see https://crbug.com/760493.
+        MediaStreamDevice video_device = video_device_info.device;
+        video_device.session_id = video_device_info.session_id;
+        video_devices.push_back(video_device);
+      }
     }
   }
-  return video_array;
+  return video_devices;
 }
 
 void MediaStreamDispatcher::OnInterfaceRequestForFrame(

diff --git a/content/renderer/media/media_stream_dispatcher.h b/content/renderer/media/media_stream_dispatcher.h
index 3620b01..b7ad1c9 100644
--- a/content/renderer/media/media_stream_dispatcher.h
+++ b/content/renderer/media/media_stream_dispatcher.h

@@ -82,7 +82,7 @@
   // Get all the media devices of video capture, e.g. webcam. This is the set
   // of devices that should be suspended when the content frame is no longer
   // being shown to the user.
-  StreamDeviceInfoArray GetNonScreenCaptureDevices();
+  MediaStreamDevices GetNonScreenCaptureDevices();
 
   // Check if the label is a valid stream.
   virtual bool IsStream(const std::string& label);

diff --git a/content/renderer/media/media_stream_dispatcher_unittest.cc b/content/renderer/media/media_stream_dispatcher_unittest.cc
index 3fad4f9..9651761f 100644
--- a/content/renderer/media/media_stream_dispatcher_unittest.cc
+++ b/content/renderer/media/media_stream_dispatcher_unittest.cc

@@ -374,9 +374,8 @@
   EXPECT_EQ(dispatcher_->label_stream_map_.size(), 2u);
 
   // Only the device with type MEDIA_DEVICE_VIDEO_CAPTURE will be returned.
-  StreamDeviceInfoArray video_device_array =
-      dispatcher_->GetNonScreenCaptureDevices();
-  EXPECT_EQ(video_device_array.size(), 1u);
+  MediaStreamDevices video_devices = dispatcher_->GetNonScreenCaptureDevices();
+  EXPECT_EQ(video_devices.size(), 1u);
 
   // Close the device from request 2.
   dispatcher_->CloseDevice(stream_label2);

diff --git a/content/renderer/media/mojo_audio_output_ipc.cc b/content/renderer/media/mojo_audio_output_ipc.cc
index d877a4d..5284fd7 100644
--- a/content/renderer/media/mojo_audio_output_ipc.cc
+++ b/content/renderer/media/mojo_audio_output_ipc.cc

@@ -191,7 +191,7 @@
   DCHECK_EQ(result, MOJO_RESULT_OK);
   DCHECK(!read_only);
 
-  delegate_->OnStreamCreated(memory_handle, socket_handle, memory_length);
+  delegate_->OnStreamCreated(memory_handle, socket_handle);
 }
 
 }  // namespace content

diff --git a/content/renderer/media/mojo_audio_output_ipc_unittest.cc b/content/renderer/media/mojo_audio_output_ipc_unittest.cc
index bfb02beb..0a85a59 100644
--- a/content/renderer/media/mojo_audio_output_ipc_unittest.cc
+++ b/content/renderer/media/mojo_audio_output_ipc_unittest.cc

@@ -169,12 +169,11 @@
   ~MockDelegate() override {}
 
   void OnStreamCreated(base::SharedMemoryHandle mem_handle,
-                       base::SyncSocket::Handle socket_handle,
-                       int length) {
+                       base::SyncSocket::Handle socket_handle) {
     base::SharedMemory sh_mem(
         mem_handle, /*read_only*/ false);  // Releases the shared memory handle.
     base::SyncSocket socket(socket_handle);  // Releases the socket descriptor.
-    GotOnStreamCreated(length);
+    GotOnStreamCreated();
   }
 
   MOCK_METHOD0(OnError, void());
@@ -182,7 +181,7 @@
                void(media::OutputDeviceStatus device_status,
                     const media::AudioParameters& output_params,
                     const std::string& matched_device_id));
-  MOCK_METHOD1(GotOnStreamCreated, void(int length));
+  MOCK_METHOD0(GotOnStreamCreated, void());
   MOCK_METHOD0(OnIPCClosed, void());
 };
 
@@ -245,7 +244,7 @@
   EXPECT_CALL(delegate, OnDeviceAuthorized(
                             media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK,
                             _, std::string(kReturnedDeviceId)));
-  EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+  EXPECT_CALL(delegate, GotOnStreamCreated());
   base::RunLoop().RunUntilIdle();
 
   ipc->CloseStream();
@@ -271,7 +270,7 @@
 
   ipc->CreateStream(&delegate, Params());
 
-  EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+  EXPECT_CALL(delegate, GotOnStreamCreated());
   base::RunLoop().RunUntilIdle();
 
   ipc->CloseStream();
@@ -298,7 +297,7 @@
         delegate,
         OnDeviceAuthorized(media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK,
                            _, std::string(kReturnedDeviceId)));
-    EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+    EXPECT_CALL(delegate, GotOnStreamCreated());
     base::RunLoop().RunUntilIdle();
     Mock::VerifyAndClearExpectations(&delegate);
 
@@ -345,7 +344,7 @@
         delegate,
         OnDeviceAuthorized(media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK,
                            _, std::string(kReturnedDeviceId)));
-    EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+    EXPECT_CALL(delegate, GotOnStreamCreated());
     base::RunLoop().RunUntilIdle();
     Mock::VerifyAndClearExpectations(&delegate);
 
@@ -492,7 +491,7 @@
   EXPECT_CALL(delegate, OnDeviceAuthorized(
                             media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK,
                             _, std::string(kReturnedDeviceId)));
-  EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+  EXPECT_CALL(delegate, GotOnStreamCreated());
   EXPECT_CALL(stream, Play());
   base::RunLoop().RunUntilIdle();
 
@@ -518,7 +517,7 @@
   EXPECT_CALL(delegate, OnDeviceAuthorized(
                             media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK,
                             _, std::string(kReturnedDeviceId)));
-  EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+  EXPECT_CALL(delegate, GotOnStreamCreated());
   EXPECT_CALL(stream, Pause());
   base::RunLoop().RunUntilIdle();
 
@@ -544,7 +543,7 @@
   EXPECT_CALL(delegate, OnDeviceAuthorized(
                             media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK,
                             _, std::string(kReturnedDeviceId)));
-  EXPECT_CALL(delegate, GotOnStreamCreated(kMemoryLength));
+  EXPECT_CALL(delegate, GotOnStreamCreated());
   EXPECT_CALL(stream, SetVolume(kNewVolume));
   base::RunLoop().RunUntilIdle();
 

diff --git a/content/renderer/media/speech_recognition_audio_sink.cc b/content/renderer/media/speech_recognition_audio_sink.cc
index 0c339cd..bd6686fe 100644
--- a/content/renderer/media/speech_recognition_audio_sink.cc
+++ b/content/renderer/media/speech_recognition_audio_sink.cc

@@ -33,8 +33,8 @@
   DCHECK(main_render_thread_checker_.CalledOnValidThread());
   DCHECK(params.IsValid());
   DCHECK(IsSupportedTrack(track));
-  const size_t kSharedMemorySize = sizeof(media::AudioInputBufferParameters) +
-                                   media::AudioBus::CalculateMemorySize(params);
+  const size_t kSharedMemorySize =
+      media::ComputeAudioInputBufferSize(params, 1u);
   CHECK(shared_memory_.Map(kSharedMemorySize));
 
   media::AudioInputBuffer* buffer =

diff --git a/content/renderer/media/speech_recognition_audio_sink_unittest.cc b/content/renderer/media/speech_recognition_audio_sink_unittest.cc
index bf452cae..0533694 100644
--- a/content/renderer/media/speech_recognition_audio_sink_unittest.cc
+++ b/content/renderer/media/speech_recognition_audio_sink_unittest.cc

@@ -124,8 +124,7 @@
       base::SharedMemoryHandle* foreign_memory_handle) {
     // Shared memory is allocated, mapped and shared.
     const uint32_t kSharedMemorySize =
-        sizeof(media::AudioInputBufferParameters) +
-        media::AudioBus::CalculateMemorySize(sink_params);
+        media::ComputeAudioInputBufferSize(sink_params, 1u);
     shared_memory_.reset(new base::SharedMemory());
     ASSERT_TRUE(shared_memory_->CreateAndMapAnonymous(kSharedMemorySize));
     memset(shared_memory_->memory(), 0, kSharedMemorySize);

diff --git a/content/renderer/media/video_capture_impl_manager.cc b/content/renderer/media/video_capture_impl_manager.cc
index b26563b..15252c5 100644
--- a/content/renderer/media/video_capture_impl_manager.cc
+++ b/content/renderer/media/video_capture_impl_manager.cc

@@ -233,14 +233,14 @@
 }
 
 void VideoCaptureImplManager::SuspendDevices(
-    const StreamDeviceInfoArray& video_device_array,
+    const MediaStreamDevices& video_devices,
     bool suspend) {
   DCHECK(render_main_task_runner_->BelongsToCurrentThread());
   if (is_suspending_all_ == suspend)
     return;
   is_suspending_all_ = suspend;
-  for (const StreamDeviceInfo& device_info : video_device_array) {
-    const media::VideoCaptureSessionId id = device_info.session_id;
+  for (const MediaStreamDevice& device : video_devices) {
+    const media::VideoCaptureSessionId id = device.session_id;
     const auto it = std::find_if(
         devices_.begin(), devices_.end(),
         [id](const DeviceEntry& entry) { return entry.session_id == id; });

diff --git a/content/renderer/media/video_capture_impl_manager.h b/content/renderer/media/video_capture_impl_manager.h
index 18f63765..6392aa0 100644
--- a/content/renderer/media/video_capture_impl_manager.h
+++ b/content/renderer/media/video_capture_impl_manager.h

@@ -16,8 +16,8 @@
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_checker.h"
 #include "content/common/content_export.h"
-#include "content/common/media/media_stream_options.h"
 #include "content/common/media/video_capture.h"
+#include "content/public/common/media_stream_request.h"
 #include "content/public/renderer/media_stream_video_sink.h"
 #include "media/capture/video_capture_types.h"
 
@@ -91,14 +91,13 @@
   void GetDeviceFormatsInUse(media::VideoCaptureSessionId id,
                              const VideoCaptureDeviceFormatsCB& callback);
 
-  // Make all VideoCaptureImpl instances in the input |video_device_array|
+  // Make all VideoCaptureImpl instances in the input |video_devices|
   // stop/resume delivering video frames to their clients, depends on flag
   // |suspend|. This is called in response to a RenderView-wide
   // PageHidden/Shown() event.
   // To suspend/resume an individual session, please call Suspend(id) or
   // Resume(id).
-  void SuspendDevices(const StreamDeviceInfoArray& video_device_array,
-                      bool suspend);
+  void SuspendDevices(const MediaStreamDevices& video_devices, bool suspend);
 
   virtual std::unique_ptr<VideoCaptureImpl> CreateVideoCaptureImplForTesting(
       media::VideoCaptureSessionId session_id) const;

diff --git a/content/renderer/media/video_capture_impl_manager_unittest.cc b/content/renderer/media/video_capture_impl_manager_unittest.cc
index d500ec2..a86e223 100644
--- a/content/renderer/media/video_capture_impl_manager_unittest.cc
+++ b/content/renderer/media/video_capture_impl_manager_unittest.cc

@@ -235,13 +235,13 @@
 
 TEST_F(VideoCaptureImplManagerTest, SuspendAndResumeSessions) {
   std::array<base::Closure, kNumClients> release_callbacks;
-  StreamDeviceInfoArray video_device_array;
+  MediaStreamDevices video_devices;
   for (size_t i = 0; i < kNumClients; ++i) {
     release_callbacks[i] =
         manager_->UseDevice(static_cast<media::VideoCaptureSessionId>(i));
-    StreamDeviceInfo video_device_info;
-    video_device_info.session_id = static_cast<media::VideoCaptureSessionId>(i);
-    video_device_array.push_back(video_device_info);
+    MediaStreamDevice video_device;
+    video_device.session_id = static_cast<media::VideoCaptureSessionId>(i);
+    video_devices.push_back(video_device);
   }
   std::array<base::Closure, kNumClients> stop_callbacks =
       StartCaptureForAllClients(false);
@@ -255,7 +255,7 @@
     EXPECT_CALL(*this, OnPaused(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnPaused(2)).WillOnce(RunClosure(quit_closure))
         .RetiresOnSaturation();
-    manager_->SuspendDevices(video_device_array, true);
+    manager_->SuspendDevices(video_devices, true);
     run_loop.Run();
   }
 
@@ -267,7 +267,7 @@
     EXPECT_CALL(*this, OnResumed(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnResumed(2)).WillOnce(RunClosure(quit_closure))
         .RetiresOnSaturation();
-    manager_->SuspendDevices(video_device_array, false);
+    manager_->SuspendDevices(video_devices, false);
     run_loop.Run();
   }
 
@@ -290,7 +290,7 @@
     EXPECT_CALL(*this, OnPaused(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnPaused(2)).WillOnce(RunClosure(quit_closure))
         .RetiresOnSaturation();
-    manager_->SuspendDevices(video_device_array, true);
+    manager_->SuspendDevices(video_devices, true);
     run_loop.Run();
   }
 
@@ -309,7 +309,7 @@
     EXPECT_CALL(*this, OnResumed(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnResumed(2)).WillOnce(RunClosure(quit_closure))
         .RetiresOnSaturation();
-    manager_->SuspendDevices(video_device_array, false);
+    manager_->SuspendDevices(video_devices, false);
     run_loop.Run();
   }
 

diff --git a/content/renderer/pepper/pepper_platform_audio_input.cc b/content/renderer/pepper/pepper_platform_audio_input.cc
index c81a40d..8006c1a 100644
--- a/content/renderer/pepper/pepper_platform_audio_input.cc
+++ b/content/renderer/pepper/pepper_platform_audio_input.cc

@@ -78,8 +78,6 @@
 void PepperPlatformAudioInput::OnStreamCreated(
     base::SharedMemoryHandle handle,
     base::SyncSocket::Handle socket_handle,
-    int length,
-    int total_segments,
     bool initially_muted) {
 #if defined(OS_WIN)
   DCHECK(handle.IsValid());
@@ -88,9 +86,7 @@
   DCHECK(base::SharedMemory::IsHandleValid(handle));
   DCHECK_NE(-1, socket_handle);
 #endif
-  DCHECK(length);
-  // TODO(yzshen): Make use of circular buffer scheme. crbug.com/181449.
-  DCHECK_EQ(1, total_segments);
+  DCHECK(handle.GetSize());
 
   if (base::ThreadTaskRunnerHandle::Get().get() != main_task_runner_.get()) {
     // If shutdown has occurred, |client_| will be NULL and the handles will be
@@ -98,12 +94,12 @@
     main_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce(&PepperPlatformAudioInput::OnStreamCreated, this, handle,
-                       socket_handle, length, total_segments, initially_muted));
+                       socket_handle, initially_muted));
   } else {
     // Must dereference the client only on the main thread. Shutdown may have
     // occurred while the request was in-flight, so we need to NULL check.
     if (client_) {
-      client_->StreamCreated(handle, length, socket_handle);
+      client_->StreamCreated(handle, handle.GetSize(), socket_handle);
     } else {
       // Clean up the handles.
       base::SyncSocket temp_socket(socket_handle);

diff --git a/content/renderer/pepper/pepper_platform_audio_input.h b/content/renderer/pepper/pepper_platform_audio_input.h
index 9060d2f..13b0137 100644
--- a/content/renderer/pepper/pepper_platform_audio_input.h
+++ b/content/renderer/pepper/pepper_platform_audio_input.h

@@ -57,8 +57,6 @@
   // media::AudioInputIPCDelegate.
   void OnStreamCreated(base::SharedMemoryHandle handle,
                        base::SyncSocket::Handle socket_handle,
-                       int length,
-                       int total_segments,
                        bool initially_muted) override;
   void OnError() override;
   void OnMuted(bool is_muted) override;

diff --git a/content/renderer/pepper/pepper_platform_audio_output.cc b/content/renderer/pepper/pepper_platform_audio_output.cc
index 8143592..9f06c13 100644
--- a/content/renderer/pepper/pepper_platform_audio_output.cc
+++ b/content/renderer/pepper/pepper_platform_audio_output.cc

@@ -90,25 +90,24 @@
 
 void PepperPlatformAudioOutput::OnStreamCreated(
     base::SharedMemoryHandle handle,
-    base::SyncSocket::Handle socket_handle,
-    int length) {
+    base::SyncSocket::Handle socket_handle) {
   DCHECK(handle.IsValid());
 #if defined(OS_WIN)
   DCHECK(socket_handle);
 #else
   DCHECK_NE(-1, socket_handle);
 #endif
-  DCHECK(length);
+  DCHECK(handle.GetSize());
 
   if (base::ThreadTaskRunnerHandle::Get().get() == main_task_runner_.get()) {
     // Must dereference the client only on the main thread. Shutdown may have
     // occurred while the request was in-flight, so we need to NULL check.
     if (client_)
-      client_->StreamCreated(handle, length, socket_handle);
+      client_->StreamCreated(handle, handle.GetSize(), socket_handle);
   } else {
     main_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&PepperPlatformAudioOutput::OnStreamCreated,
-                                  this, handle, socket_handle, length));
+                                  this, handle, socket_handle));
   }
 }
 

diff --git a/content/renderer/pepper/pepper_platform_audio_output.h b/content/renderer/pepper/pepper_platform_audio_output.h
index 6499711..a24a629 100644
--- a/content/renderer/pepper/pepper_platform_audio_output.h
+++ b/content/renderer/pepper/pepper_platform_audio_output.h

@@ -58,8 +58,7 @@
                           const media::AudioParameters& output_params,
                           const std::string& matched_device_id) override;
   void OnStreamCreated(base::SharedMemoryHandle handle,
-                       base::SyncSocket::Handle socket_handle,
-                       int length) override;
+                       base::SyncSocket::Handle socket_handle) override;
   void OnIPCClosed() override;
 
  protected:

diff --git a/content/renderer/pepper/pepper_platform_audio_output_dev.cc b/content/renderer/pepper/pepper_platform_audio_output_dev.cc
index 454c6c8..e6b8d1a 100644
--- a/content/renderer/pepper/pepper_platform_audio_output_dev.cc
+++ b/content/renderer/pepper/pepper_platform_audio_output_dev.cc

@@ -182,21 +182,20 @@
 
 void PepperPlatformAudioOutputDev::OnStreamCreated(
     base::SharedMemoryHandle handle,
-    base::SyncSocket::Handle socket_handle,
-    int length) {
+    base::SyncSocket::Handle socket_handle) {
   DCHECK(handle.IsValid());
 #if defined(OS_WIN)
   DCHECK(socket_handle);
 #else
   DCHECK_NE(-1, socket_handle);
 #endif
-  DCHECK(length);
+  DCHECK(handle.GetSize());
 
   if (base::ThreadTaskRunnerHandle::Get().get() == main_task_runner_.get()) {
     // Must dereference the client only on the main thread. Shutdown may have
     // occurred while the request was in-flight, so we need to NULL check.
     if (client_)
-      client_->StreamCreated(handle, length, socket_handle);
+      client_->StreamCreated(handle, handle.GetSize(), socket_handle);
   } else {
     DCHECK(io_task_runner_->BelongsToCurrentThread());
     if (state_ != CREATING_STREAM)
@@ -209,7 +208,7 @@
     main_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce(&PepperPlatformAudioOutputDev::OnStreamCreated, this,
-                       handle, socket_handle, length));
+                       handle, socket_handle));
   }
 }
 

diff --git a/content/renderer/pepper/pepper_platform_audio_output_dev.h b/content/renderer/pepper/pepper_platform_audio_output_dev.h
index e44dce8..24ab7da 100644
--- a/content/renderer/pepper/pepper_platform_audio_output_dev.h
+++ b/content/renderer/pepper/pepper_platform_audio_output_dev.h

@@ -64,8 +64,7 @@
                           const media::AudioParameters& output_params,
                           const std::string& matched_device_id) override;
   void OnStreamCreated(base::SharedMemoryHandle handle,
-                       base::SyncSocket::Handle socket_handle,
-                       int length) override;
+                       base::SyncSocket::Handle socket_handle) override;
   void OnIPCClosed() override;
 
  protected:

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 7fc5946..7e729e5 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -104,7 +104,6 @@
 #include "content/renderer/accessibility/render_accessibility_impl.h"
 #include "content/renderer/browser_plugin/browser_plugin.h"
 #include "content/renderer/browser_plugin/browser_plugin_manager.h"
-#include "content/renderer/child_frame_compositing_helper.h"
 #include "content/renderer/content_security_policy_util.h"
 #include "content/renderer/context_menu_params_builder.h"
 #include "content/renderer/devtools/devtools_agent.h"
@@ -2994,7 +2993,7 @@
   return base::MakeUnique<RendererWebApplicationCacheHostImpl>(
       RenderViewImpl::FromWebView(frame_->View()), client,
       RenderThreadImpl::current()->appcache_dispatcher()->backend_proxy(),
-      navigation_state->request_params().appcache_host_id);
+      navigation_state->request_params().appcache_host_id, routing_id_);
 }
 
 std::unique_ptr<blink::WebContentSettingsClient>
@@ -5250,11 +5249,7 @@
       },
       weak_factory_.GetWeakPtr());
 
-  // Chrome doesn't use interface versioning.
-  mojom::URLLoaderFactoryPtr url_loader_factory;
-  url_loader_factory.Bind(mojom::URLLoaderFactoryPtrInfo(
-      mojo::ScopedMessagePipeHandle(commit_data.url_loader_factory), 0u));
-  custom_url_loader_factory_ = std::move(url_loader_factory);
+  SetCustomURLLoadeFactory(commit_data.url_loader_factory);
 
   // If the request was initiated in the context of a user gesture then make
   // sure that the navigation also executes in the context of a user gesture.
@@ -5983,7 +5978,7 @@
   params.uses_post = IsHttpPost(info.url_request);
   params.resource_request_body =
       GetRequestBodyForWebURLRequest(info.url_request);
-  params.extra_headers = GetWebURLRequestHeaders(info.url_request);
+  params.extra_headers = GetWebURLRequestHeadersAsString(info.url_request);
   params.referrer = send_referrer ? RenderViewImpl::GetReferrerFromRequest(
                                         frame_, info.url_request)
                                   : content::Referrer();
@@ -6358,6 +6353,15 @@
   GetRenderWidget()->UpdateSelectionBounds();
 }
 
+void RenderFrameImpl::SetCustomURLLoadeFactory(
+    mojo::MessagePipeHandle custom_loader_factory_handle) {
+  // Chrome doesn't use interface versioning.
+  mojom::URLLoaderFactoryPtr url_loader_factory;
+  url_loader_factory.Bind(mojom::URLLoaderFactoryPtrInfo(
+      mojo::ScopedMessagePipeHandle(custom_loader_factory_handle), 0u));
+  custom_url_loader_factory_ = std::move(url_loader_factory);
+}
+
 void RenderFrameImpl::InitializeUserMediaClient() {
   RenderThreadImpl* render_thread = RenderThreadImpl::current();
   if (!render_thread)  // Will be NULL during unit tests.
@@ -6469,7 +6473,7 @@
       info.navigation_type == blink::kWebNavigationTypeFormResubmitted;
 
   BeginNavigationParams begin_navigation_params(
-      GetWebURLRequestHeaders(info.url_request), load_flags,
+      GetWebURLRequestHeadersAsString(info.url_request), load_flags,
       info.url_request.HasUserGesture(),
       info.url_request.GetServiceWorkerMode() !=
           blink::WebURLRequest::ServiceWorkerMode::kAll,

diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 6c63b98..39d9f5ec 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h

@@ -132,7 +132,6 @@
 
 class AssociatedInterfaceProviderImpl;
 class BlinkInterfaceRegistryImpl;
-class ChildFrameCompositingHelper;
 class ChildURLLoaderFactoryGetter;
 class CompositorDependencies;
 class DevToolsAgent;
@@ -785,6 +784,10 @@
   // selection handles in sync with the webpage.
   void SyncSelectionIfRequired();
 
+  // Sets the custom URLLoaderFactory instance to be used for network requests.
+  void SetCustomURLLoadeFactory(
+      mojo::MessagePipeHandle custom_loader_factory_handle);
+
  protected:
   explicit RenderFrameImpl(const CreateParams& params);
 
@@ -1280,8 +1283,6 @@
   // All the registered observers.
   base::ObserverList<RenderFrameObserver> observers_;
 
-  scoped_refptr<ChildFrameCompositingHelper> compositing_helper_;
-
   // External context menu requests we're waiting for. "Internal"
   // (WebKit-originated) context menu events will have an ID of 0 and will not
   // be in this map.

diff --git a/content/renderer/render_frame_proxy.cc b/content/renderer/render_frame_proxy.cc
index c754839..f650918 100644
--- a/content/renderer/render_frame_proxy.cc
+++ b/content/renderer/render_frame_proxy.cc

@@ -356,8 +356,8 @@
     return;
 
   if (!compositing_helper_) {
-    compositing_helper_ =
-        ChildFrameCompositingHelper::CreateForRenderFrameProxy(this);
+    compositing_helper_.reset(
+        ChildFrameCompositingHelper::CreateForRenderFrameProxy(this));
     if (enable_surface_synchronization_) {
       // We wait until there is a single CompositorFrame guaranteed to be
       // available and ready for display in the display compositor before using
@@ -535,7 +535,7 @@
   params.url = request.Url();
   params.uses_post = request.HttpMethod().Utf8() == "POST";
   params.resource_request_body = GetRequestBodyForWebURLRequest(request);
-  params.extra_headers = GetWebURLRequestHeaders(request);
+  params.extra_headers = GetWebURLRequestHeadersAsString(request);
   params.referrer = Referrer(blink::WebStringToGURL(request.HttpHeaderField(
                                  blink::WebString::FromUTF8("Referer"))),
                              request.GetReferrerPolicy());

diff --git a/content/renderer/render_frame_proxy.h b/content/renderer/render_frame_proxy.h
index 3c203de6..b9c0d32 100644
--- a/content/renderer/render_frame_proxy.h
+++ b/content/renderer/render_frame_proxy.h

@@ -199,7 +199,7 @@
   // Stores the WebRemoteFrame we are associated with.
   blink::WebRemoteFrame* web_frame_;
   std::string unique_name_;
-  scoped_refptr<ChildFrameCompositingHelper> compositing_helper_;
+  std::unique_ptr<ChildFrameCompositingHelper> compositing_helper_;
 
   RenderViewImpl* render_view_;
   RenderWidget* render_widget_;

diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index dbf1a196..4bbfbf6 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc

@@ -65,13 +65,13 @@
 #include "content/child/blob_storage/blob_message_filter.h"
 #include "content/child/child_histogram_message_filter.h"
 #include "content/child/child_resource_message_filter.h"
-#include "content/child/db_message_filter.h"
 #include "content/child/indexed_db/indexed_db_dispatcher.h"
 #include "content/child/memory/child_memory_coordinator_impl.h"
 #include "content/child/resource_dispatcher.h"
 #include "content/child/resource_scheduling_filter.h"
 #include "content/child/runtime_features.h"
 #include "content/child/thread_safe_sender.h"
+#include "content/child/web_database_impl.h"
 #include "content/child/web_database_observer_impl.h"
 #include "content/child/worker_thread_registry.h"
 #include "content/common/child_process_messages.h"
@@ -708,9 +708,6 @@
 
   blob_message_filter_ = new BlobMessageFilter(GetFileThreadTaskRunner());
   AddFilter(blob_message_filter_.get());
-  db_message_filter_ = new DBMessageFilter();
-  AddFilter(db_message_filter_.get());
-
   vc_manager_.reset(new VideoCaptureImplManager());
 
   browser_plugin_manager_.reset(new BrowserPluginManager());
@@ -762,13 +759,20 @@
   }
 #endif
 
-  auto registry = base::MakeUnique<service_manager::BinderRegistryWithArgs<
-      const service_manager::BindSourceInfo&>>();
-  registry->AddInterface(base::Bind(&CreateFrameFactory),
-                         base::ThreadTaskRunnerHandle::Get());
+  auto registry = base::MakeUnique<service_manager::BinderRegistry>();
+  registry->AddInterface(base::Bind(&WebDatabaseImpl::Create),
+                         GetIOTaskRunner());
+  GetServiceManagerConnection()->AddConnectionFilter(
+      base::MakeUnique<SimpleConnectionFilter>(std::move(registry)));
+
+  auto registry_with_source_info =
+      base::MakeUnique<service_manager::BinderRegistryWithArgs<
+          const service_manager::BindSourceInfo&>>();
+  registry_with_source_info->AddInterface(base::Bind(&CreateFrameFactory),
+                                          base::ThreadTaskRunnerHandle::Get());
   GetServiceManagerConnection()->AddConnectionFilter(
       base::MakeUnique<SimpleConnectionFilterWithSourceInfo>(
-          std::move(registry)));
+          std::move(registry_with_source_info)));
 
   GetContentClient()->renderer()->RenderThreadStarted();
 

diff --git a/content/renderer/render_thread_impl.h b/content/renderer/render_thread_impl.h
index 5bbbf07d..f912375 100644
--- a/content/renderer/render_thread_impl.h
+++ b/content/renderer/render_thread_impl.h

@@ -131,7 +131,6 @@
 class BrowserPluginManager;
 class CacheStorageDispatcher;
 class CompositorForwardingMessageFilter;
-class DBMessageFilter;
 class DevToolsAgentFilter;
 class DomStorageDispatcher;
 class FrameSwapMessageQueue;
@@ -622,7 +621,6 @@
 
   // Used on the renderer and IPC threads.
   scoped_refptr<BlobMessageFilter> blob_message_filter_;
-  scoped_refptr<DBMessageFilter> db_message_filter_;
   scoped_refptr<AudioInputMessageFilter> audio_input_message_filter_;
   scoped_refptr<MidiMessageFilter> midi_message_filter_;
   scoped_refptr<DevToolsAgentFilter> devtools_agent_message_filter_;

diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 5f27dda4..516fb56 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc

@@ -2398,10 +2398,10 @@
   if (!media_stream_dispatcher)
     return;
 
-  StreamDeviceInfoArray video_array =
+  MediaStreamDevices video_devices =
       media_stream_dispatcher->GetNonScreenCaptureDevices();
   RenderThreadImpl::current()->video_capture_impl_manager()->SuspendDevices(
-      video_array, suspend);
+      video_devices, suspend);
 #endif  // BUILDFLAG(ENABLE_WEBRTC)
 }
 #endif  // defined(OS_ANDROID)

diff --git a/content/renderer/renderer_webapplicationcachehost_impl.cc b/content/renderer/renderer_webapplicationcachehost_impl.cc
index 535ad9e..1a54f5d 100644
--- a/content/renderer/renderer_webapplicationcachehost_impl.cc
+++ b/content/renderer/renderer_webapplicationcachehost_impl.cc

@@ -5,6 +5,7 @@
 #include "content/renderer/renderer_webapplicationcachehost_impl.h"
 
 #include "content/common/view_messages.h"
+#include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
@@ -20,9 +21,11 @@
     RenderViewImpl* render_view,
     WebApplicationCacheHostClient* client,
     AppCacheBackend* backend,
-    int appcache_host_id)
+    int appcache_host_id,
+    int frame_routing_id)
     : WebApplicationCacheHostImpl(client, backend, appcache_host_id),
-      routing_id_(render_view->GetRoutingID()) {}
+      routing_id_(render_view->GetRoutingID()),
+      frame_routing_id_(frame_routing_id) {}
 
 void RendererWebApplicationCacheHostImpl::OnLogMessage(
     AppCacheLogLevel log_level, const std::string& message) {
@@ -59,6 +62,14 @@
   WebApplicationCacheHostImpl::OnCacheSelected(info);
 }
 
+void RendererWebApplicationCacheHostImpl::SetSubresourceFactory(
+    mojo::MessagePipeHandle loader_factory_pipe_handle) {
+  RenderFrameImpl* render_frame =
+      RenderFrameImpl::FromRoutingID(frame_routing_id_);
+  if (render_frame)
+    render_frame->SetCustomURLLoadeFactory(loader_factory_pipe_handle);
+}
+
 RenderViewImpl* RendererWebApplicationCacheHostImpl::GetRenderView() {
   return RenderViewImpl::FromRoutingID(routing_id_);
 }

diff --git a/content/renderer/renderer_webapplicationcachehost_impl.h b/content/renderer/renderer_webapplicationcachehost_impl.h
index 0250719..273308e 100644
--- a/content/renderer/renderer_webapplicationcachehost_impl.h
+++ b/content/renderer/renderer_webapplicationcachehost_impl.h

@@ -16,7 +16,8 @@
       RenderViewImpl* render_view,
       blink::WebApplicationCacheHostClient* client,
       AppCacheBackend* backend,
-      int appcache_host_id);
+      int appcache_host_id,
+      int frame_routing_id);
 
   // WebApplicationCacheHostImpl:
   void OnLogMessage(AppCacheLogLevel log_level,
@@ -24,10 +25,14 @@
   void OnContentBlocked(const GURL& manifest_url) override;
   void OnCacheSelected(const AppCacheInfo& info) override;
 
+  void SetSubresourceFactory(
+      mojo::MessagePipeHandle loader_factory_pipe_handle) override;
+
  private:
   RenderViewImpl* GetRenderView();
 
   int routing_id_;
+  int frame_routing_id_;
 };
 
 }  // namespace content

diff --git a/content/shell/BUILD.gn b/content/shell/BUILD.gn
index 8712559..ad76d63 100644
--- a/content/shell/BUILD.gn
+++ b/content/shell/BUILD.gn

@@ -98,6 +98,8 @@
     "browser/layout_test/secondary_test_window_observer.h",
     "browser/layout_test/test_info_extractor.cc",
     "browser/layout_test/test_info_extractor.h",
+    "browser/renderer_host/shell_render_widget_host_view_mac_delegate.h",
+    "browser/renderer_host/shell_render_widget_host_view_mac_delegate.mm",
     "browser/shell.cc",
     "browser/shell.h",
     "browser/shell_access_token_store.cc",

diff --git a/content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.h b/content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.h
new file mode 100644
index 0000000..0920551
--- /dev/null
+++ b/content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.h

@@ -0,0 +1,21 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_SHELL_BROWSER_RENDERER_HOST_CHROME_RENDER_WIDGET_HOST_VIEW_MAC_DELEGATE_H_
+#define CONTENT_SHELL_BROWSER_RENDERER_HOST_CHROME_RENDER_WIDGET_HOST_VIEW_MAC_DELEGATE_H_
+
+#import <Cocoa/Cocoa.h>
+
+#include <memory>
+
+#include "base/mac/scoped_nsobject.h"
+#import "content/public/browser/render_widget_host_view_mac_delegate.h"
+
+@interface ShellRenderWidgetHostViewMacDelegate
+    : NSObject<RenderWidgetHostViewMacDelegate> {
+}
+
+@end
+
+#endif  // CONTENT_SHELL_BROWSER_RENDERER_HOST_CHROME_RENDER_WIDGET_HOST_VIEW_MAC_DELEGATE_H_

diff --git a/content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.mm b/content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.mm
new file mode 100644
index 0000000..3b8f2b3
--- /dev/null
+++ b/content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.mm

@@ -0,0 +1,56 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.h"
+
+#include "base/command_line.h"
+#include "content/shell/common/layout_test/layout_test_switches.h"
+
+@interface ShellRenderWidgetHostViewMacDelegate () {
+  BOOL drop_events_;
+}
+@end
+
+@implementation ShellRenderWidgetHostViewMacDelegate
+
+- (id)init {
+  if ((self = [super init])) {
+    // Throw out all native input events if we are running with layout test
+    // enabled.
+    drop_events_ = base::CommandLine::ForCurrentProcess()->HasSwitch(
+        switches::kRunLayoutTest);
+  }
+  return self;
+}
+- (BOOL)handleEvent:(NSEvent*)event {
+  return drop_events_;
+}
+
+- (void)beginGestureWithEvent:(NSEvent*)event {
+}
+
+- (void)endGestureWithEvent:(NSEvent*)event {
+}
+
+- (void)touchesMovedWithEvent:(NSEvent*)event {
+}
+
+- (void)touchesBeganWithEvent:(NSEvent*)event {
+}
+
+- (void)touchesCancelledWithEvent:(NSEvent*)event {
+}
+
+- (void)touchesEndedWithEvent:(NSEvent*)event {
+}
+
+- (void)rendererHandledWheelEvent:(const blink::WebMouseWheelEvent&)event
+                         consumed:(BOOL)consumed {
+}
+
+- (void)rendererHandledGestureScrollEvent:(const blink::WebGestureEvent&)event
+                                 consumed:(BOOL)consumed {
+}
+
+@end

diff --git a/content/shell/browser/shell_browser_main_parts.cc b/content/shell/browser/shell_browser_main_parts.cc
index 32524409..233cf66 100644
--- a/content/shell/browser/shell_browser_main_parts.cc
+++ b/content/shell/browser/shell_browser_main_parts.cc

@@ -43,6 +43,9 @@
 #include "net/base/network_change_notifier.h"
 #endif
 
+#if defined(USE_X11)
+#include "ui/base/x/x11_util.h"  // nogncheck
+#endif
 #if defined(USE_AURA) && defined(USE_X11)
 #include "ui/events/devices/x11/touch_factory_x11.h"  // nogncheck
 #endif
@@ -142,6 +145,9 @@
 }
 
 void ShellBrowserMainParts::PreEarlyInitialization() {
+#if defined(USE_X11)
+  ui::SetDefaultX11ErrorHandlers();
+#endif
 #if !defined(OS_CHROMEOS) && defined(USE_AURA) && defined(OS_LINUX)
   ui::InitializeInputMethodForTesting();
 #endif

diff --git a/content/shell/browser/shell_web_contents_view_delegate.h b/content/shell/browser/shell_web_contents_view_delegate.h
index 0a537a55..2bce9771 100644
--- a/content/shell/browser/shell_web_contents_view_delegate.h
+++ b/content/shell/browser/shell_web_contents_view_delegate.h

@@ -34,6 +34,9 @@
 
 #if defined(OS_MACOSX)
   void ActionPerformed(int id);
+  NSObject<RenderWidgetHostViewMacDelegate>* CreateRenderWidgetHostViewDelegate(
+      content::RenderWidgetHost* render_widget_host,
+      bool is_popup) override;
 #endif
 
  private:

diff --git a/content/shell/browser/shell_web_contents_view_delegate_mac.mm b/content/shell/browser/shell_web_contents_view_delegate_mac.mm
index 489cf3c..7c31c79 100644
--- a/content/shell/browser/shell_web_contents_view_delegate_mac.mm
+++ b/content/shell/browser/shell_web_contents_view_delegate_mac.mm

@@ -13,6 +13,7 @@
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/context_menu_params.h"
+#include "content/shell/browser/renderer_host/shell_render_widget_host_view_mac_delegate.h"
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_browser_context.h"
 #include "content/shell/browser/shell_browser_main_parts.h"
@@ -262,4 +263,11 @@
   }
 }
 
+NSObject<RenderWidgetHostViewMacDelegate>*
+ShellWebContentsViewDelegate::CreateRenderWidgetHostViewDelegate(
+    content::RenderWidgetHost* render_widget_host,
+    bool is_popup) {
+  return [[ShellRenderWidgetHostViewMacDelegate alloc] init];
+}
+
 }  // namespace content

diff --git a/content/shell/test_runner/web_ax_object_proxy.cc b/content/shell/test_runner/web_ax_object_proxy.cc
index 92da2d0..60c86bd 100644
--- a/content/shell/test_runner/web_ax_object_proxy.cc
+++ b/content/shell/test_runner/web_ax_object_proxy.cc

@@ -656,6 +656,10 @@
       .SetMethod("isAttributeSettable", &WebAXObjectProxy::IsAttributeSettable)
       .SetMethod("isPressActionSupported",
                  &WebAXObjectProxy::IsPressActionSupported)
+      .SetMethod("isIncrementActionSupported",
+                 &WebAXObjectProxy::IsIncrementActionSupported)
+      .SetMethod("isDecrementActionSupported",
+                 &WebAXObjectProxy::IsDecrementActionSupported)
       .SetMethod("parentElement", &WebAXObjectProxy::ParentElement)
       .SetMethod("increment", &WebAXObjectProxy::Increment)
       .SetMethod("decrement", &WebAXObjectProxy::Decrement)
@@ -1460,9 +1464,8 @@
 
 void WebAXObjectProxy::SetSelectedTextRange(int selection_start, int length) {
   accessibility_object_.UpdateLayoutAndCheckValidity();
-  accessibility_object_.SetSelection(accessibility_object_, selection_start,
-                                     accessibility_object_,
-                                     selection_start + length);
+  accessibility_object_.SetSelectedTextRange(selection_start,
+                                             selection_start + length);
 }
 
 void WebAXObjectProxy::SetSelection(v8::Local<v8::Value> anchor_object,
@@ -1508,6 +1511,16 @@
   return accessibility_object_.CanPress();
 }
 
+bool WebAXObjectProxy::IsIncrementActionSupported() {
+  accessibility_object_.UpdateLayoutAndCheckValidity();
+  return accessibility_object_.CanIncrement();
+}
+
+bool WebAXObjectProxy::IsDecrementActionSupported() {
+  accessibility_object_.UpdateLayoutAndCheckValidity();
+  return accessibility_object_.CanDecrement();
+}
+
 v8::Local<v8::Object> WebAXObjectProxy::ParentElement() {
   accessibility_object_.UpdateLayoutAndCheckValidity();
   blink::WebAXObject parent_object = accessibility_object_.ParentObject();
@@ -1532,7 +1545,7 @@
 
 void WebAXObjectProxy::Press() {
   accessibility_object_.UpdateLayoutAndCheckValidity();
-  accessibility_object_.Click();
+  accessibility_object_.Press();
 }
 
 bool WebAXObjectProxy::SetValue(const std::string& value) {
@@ -1564,7 +1577,7 @@
 
 void WebAXObjectProxy::TakeFocus() {
   accessibility_object_.UpdateLayoutAndCheckValidity();
-  accessibility_object_.Focus();
+  accessibility_object_.SetFocused(true);
 }
 
 void WebAXObjectProxy::ScrollToMakeVisible() {

diff --git a/content/test/data/accessibility/aria/aria-owns-actual-mac.txt b/content/test/data/accessibility/aria/aria-owns-actual-mac.txt
deleted file mode 100644
index a1c32220..0000000
--- a/content/test/data/accessibility/aria/aria-owns-actual-mac.txt
+++ /dev/null

@@ -1,7 +0,0 @@
-AXWebArea
-++AXList
-++++AXGroup AXTitle='Birds'
-++++++AXGroup
-++++++++AXListMarker AXValue='•'
-++++++++AXStaticText AXValue='Birds'
-<-- End-of-file -->
\ No newline at end of file

diff --git a/content/test/data/appcache/simple_page.manifest b/content/test/data/appcache/simple_page.manifest
index 647385e..5ccb3db9 100644
--- a/content/test/data/appcache/simple_page.manifest
+++ b/content/test/data/appcache/simple_page.manifest

@@ -1,2 +1,5 @@
 CACHE MANIFEST
-/appcache/logo.png
\ No newline at end of file
+/appcache/logo.png
+
+NETWORK:
+*
\ No newline at end of file

diff --git a/content/test/data/appcache/simple_page_redirected_resource_manifest.html b/content/test/data/appcache/simple_page_redirected_resource_manifest.html
new file mode 100644
index 0000000..0cdaccf0
--- /dev/null
+++ b/content/test/data/appcache/simple_page_redirected_resource_manifest.html

@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html manifest="simple_page.manifest">
+<head>
+  <title>OK</title>
+  <script type="text/javascript">
+    function onCachedEvent() {
+      window.document.title = "AppCache updated";
+    }
+
+    function onLoad() {
+      window.applicationCache.addEventListener('cached', onCachedEvent, false);
+    }
+
+    function onImageLoad() {
+      window.document.title = "AppCache image loaded";
+    }
+
+  </script>
+</head>
+
+<body onload="onLoad()">
+  <p><img src="redirect/logo.png" width="336" height="69" onload="onImageLoad()"/></p>
+  AppCache test for verifying that redirected subresources which are specified in the
+  cache load correctly. The title of the page is set to AppCache image loaded if the
+  subresource was successfully loaded.
+</body>
+</html>

diff --git a/device/bluetooth/bluez/bluetooth_adapter_bluez.cc b/device/bluetooth/bluez/bluetooth_adapter_bluez.cc
index a84aaf4..3f66ab7 100644
--- a/device/bluetooth/bluez/bluetooth_adapter_bluez.cc
+++ b/device/bluetooth/bluez/bluetooth_adapter_bluez.cc

@@ -1042,9 +1042,8 @@
   // Take the lower 2 bytes of hashed Bluetooth address and combine it with the
   // device type to create a more identifiable device name.
   const std::string address = GetAddress();
-  alias = base::StringPrintf(
-      "%s_%04X", alias.c_str(),
-      base::SuperFastHash(address.data(), address.size()) & 0xFFFF);
+  alias = base::StringPrintf("%s_%04X", alias.c_str(),
+                             base::PersistentHash(address) & 0xFFFF);
   SetName(alias, base::Bind(&base::DoNothing), base::Bind(&base::DoNothing));
 }
 #endif

diff --git a/device/bluetooth/dbus/bluetooth_le_advertising_manager_client.cc b/device/bluetooth/dbus/bluetooth_le_advertising_manager_client.cc
index 277f81c..a4e2738 100644
--- a/device/bluetooth/dbus/bluetooth_le_advertising_manager_client.cc
+++ b/device/bluetooth/dbus/bluetooth_le_advertising_manager_client.cc

@@ -74,15 +74,8 @@
     writer.OpenArray("{sv}", &array_writer);
     writer.CloseContainer(&array_writer);
 
-    DCHECK(object_manager_);
-    dbus::ObjectProxy* object_proxy =
-        object_manager_->GetObjectProxy(manager_object_path);
-    object_proxy->CallMethodWithErrorCallback(
-        &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnSuccess,
-                   weak_ptr_factory_.GetWeakPtr(), callback),
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnError,
-                   weak_ptr_factory_.GetWeakPtr(), error_callback));
+    CallObjectProxyMethod(manager_object_path, &method_call, callback,
+                          error_callback);
   }
 
   // BluetoothAdvertisementManagerClient override.
@@ -98,15 +91,8 @@
     dbus::MessageWriter writer(&method_call);
     writer.AppendObjectPath(advertisement_object_path);
 
-    DCHECK(object_manager_);
-    dbus::ObjectProxy* object_proxy =
-        object_manager_->GetObjectProxy(manager_object_path);
-    object_proxy->CallMethodWithErrorCallback(
-        &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnSuccess,
-                   weak_ptr_factory_.GetWeakPtr(), callback),
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnError,
-                   weak_ptr_factory_.GetWeakPtr(), error_callback));
+    CallObjectProxyMethod(manager_object_path, &method_call, callback,
+                          error_callback);
   }
 
   void SetAdvertisingInterval(const dbus::ObjectPath& manager_object_path,
@@ -122,15 +108,8 @@
     writer.AppendUint16(min_interval_ms);
     writer.AppendUint16(max_interval_ms);
 
-    DCHECK(object_manager_);
-    dbus::ObjectProxy* object_proxy =
-        object_manager_->GetObjectProxy(manager_object_path);
-    object_proxy->CallMethodWithErrorCallback(
-        &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnSuccess,
-                   weak_ptr_factory_.GetWeakPtr(), callback),
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnError,
-                   weak_ptr_factory_.GetWeakPtr(), error_callback));
+    CallObjectProxyMethod(manager_object_path, &method_call, callback,
+                          error_callback);
   }
 
   void ResetAdvertising(const dbus::ObjectPath& manager_object_path,
@@ -140,15 +119,8 @@
         bluetooth_advertising_manager::kBluetoothAdvertisingManagerInterface,
         bluetooth_advertising_manager::kResetAdvertising);
 
-    DCHECK(object_manager_);
-    dbus::ObjectProxy* object_proxy =
-        object_manager_->GetObjectProxy(manager_object_path);
-    object_proxy->CallMethodWithErrorCallback(
-        &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnSuccess,
-                   weak_ptr_factory_.GetWeakPtr(), callback),
-        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnError,
-                   weak_ptr_factory_.GetWeakPtr(), error_callback));
+    CallObjectProxyMethod(manager_object_path, &method_call, callback,
+                          error_callback);
   }
 
  protected:
@@ -164,6 +136,29 @@
   }
 
  private:
+  // Unified function to call object proxy method. This includes checking
+  // if the bluetooth adapter exists and run error callback if it doesn't.
+  void CallObjectProxyMethod(const dbus::ObjectPath& manager_object_path,
+                             dbus::MethodCall* method_call,
+                             const base::Closure& callback,
+                             const ErrorCallback& error_callback) {
+    DCHECK(object_manager_);
+    dbus::ObjectProxy* object_proxy =
+        object_manager_->GetObjectProxy(manager_object_path);
+    if (!object_proxy) {
+      error_callback.Run(bluetooth_advertising_manager::kErrorFailed,
+                         "Adapter does not exist.");
+      return;
+    }
+
+    object_proxy->CallMethodWithErrorCallback(
+        method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
+        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnSuccess,
+                   weak_ptr_factory_.GetWeakPtr(), callback),
+        base::Bind(&BluetoothAdvertisementManagerClientImpl::OnError,
+                   weak_ptr_factory_.GetWeakPtr(), error_callback));
+  }
+
   // Called by dbus::ObjectManager when an object with the advertising manager
   // interface is created. Informs observers.
   void ObjectAdded(const dbus::ObjectPath& object_path,

diff --git a/device/serial/serial_device_enumerator_linux.cc b/device/serial/serial_device_enumerator_linux.cc
index 100f7dd..ad69644b 100644
--- a/device/serial/serial_device_enumerator_linux.cc
+++ b/device/serial/serial_device_enumerator_linux.cc

@@ -11,6 +11,7 @@
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/threading/thread_restrictions.h"
 
 namespace device {
 
@@ -40,6 +41,8 @@
 
 std::vector<mojom::SerialDeviceInfoPtr>
 SerialDeviceEnumeratorLinux::GetDevices() {
+  base::ThreadRestrictions::AssertIOAllowed();
+
   std::vector<mojom::SerialDeviceInfoPtr> devices;
   ScopedUdevEnumeratePtr enumerate(udev_enumerate_new(udev_.get()));
   if (!enumerate) {

diff --git a/device/serial/serial_device_enumerator_mac.cc b/device/serial/serial_device_enumerator_mac.cc
index 333da5b..f07ddfa 100644
--- a/device/serial/serial_device_enumerator_mac.cc
+++ b/device/serial/serial_device_enumerator_mac.cc

@@ -22,6 +22,7 @@
 #include "base/strings/pattern.h"
 #include "base/strings/string_util.h"
 #include "base/strings/sys_string_conversions.h"
+#include "base/threading/thread_restrictions.h"
 
 namespace device {
 
@@ -216,6 +217,8 @@
 
 std::vector<mojom::SerialDeviceInfoPtr>
 SerialDeviceEnumeratorMac::GetDevices() {
+  base::ThreadRestrictions::AssertIOAllowed();
+
   std::vector<mojom::SerialDeviceInfoPtr> devices = GetDevicesNew();
   std::vector<mojom::SerialDeviceInfoPtr> old_devices = GetDevicesOld();
 

diff --git a/device/serial/serial_device_enumerator_win.cc b/device/serial/serial_device_enumerator_win.cc
index ef617fa..475bb51 100644
--- a/device/serial/serial_device_enumerator_win.cc
+++ b/device/serial/serial_device_enumerator_win.cc

@@ -17,6 +17,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/threading/thread_restrictions.h"
 #include "base/win/registry.h"
 #include "third_party/re2/src/re2/re2.h"
 
@@ -166,6 +167,8 @@
 
 std::vector<mojom::SerialDeviceInfoPtr>
 SerialDeviceEnumeratorWin::GetDevices() {
+  base::ThreadRestrictions::AssertIOAllowed();
+
   std::vector<mojom::SerialDeviceInfoPtr> devices = GetDevicesNew();
   std::vector<mojom::SerialDeviceInfoPtr> old_devices = GetDevicesOld();
 

diff --git a/docs/qtcreator.md b/docs/qtcreator.md
index 38c0aa0..702354d 100644
--- a/docs/qtcreator.md
+++ b/docs/qtcreator.md

@@ -1,9 +1,9 @@
 # Use Qt Creator as IDE or GUI Debugger
 
 [Qt Creator](https://www.qt.io/ide/)
-([Wiki](https://en.wikipedia.org/wiki/Qt_Creator)) is a cross-platform C++ IDE. 
+([Wiki](https://en.wikipedia.org/wiki/Qt_Creator)) is a cross-platform C++ IDE.
 
-You can use Qt Creator as a daily IDE or just as a GDB frontend and that does 
+You can use Qt Creator as a daily IDE or just as a GDB frontend and that does
 not require project configuration.
 
 [TOC]
@@ -24,15 +24,16 @@
 1. Install latest Qt Creator
 2. under chromium/src `gn gen out/Default --ide=qtcreator`
 3. qtcreator out/Default/qtcreator_project/all.creator
+4. Help - Plugins - check ClangCodeModel to enable std completion
 
-It takes 3 minutes to parsing C++ files in my workstation!!! And It will not 
+It takes 3 minutes to parsing C++ files in my workstation!!! And It will not
 block you while parsing.
 
 #### Code Style
 
 1. Help - About Plugins enable Beautifier.
-2. Tools - Options - Beautifier - Clang Format, 
-   change Clang format command: `$depot_tools_dir/clang-format`, select use 
+2. Tools - Options - Beautifier - Clang Format,
+   change Clang format command: `$depot_tools_dir/clang-format`, select use
    predefined style: file. You can also set a keyboard shortcut for it.
 3. Tools - Options - Code Style import this xml file
 
@@ -50,7 +51,7 @@
    <value type="bool" key="BindStarToLeftSpecifier">false</value>
    <value type="bool" key="BindStarToRightSpecifier">false</value>
    <value type="bool" key="BindStarToTypeName">true</value>
-   <value type="bool" 
+   <value type="bool"
      key="ExtraPaddingForConditionsIfConfusingAlign">true</value>
    <value type="bool" key="IndentAccessSpecifiers">true</value>
    <value type="bool" key="IndentBlockBody">true</value>
@@ -83,19 +84,19 @@
 
 #### Build & Run
 
-In left panel, projects - setup the ninja command in build and clean step and   
+In left panel, projects - setup the ninja command in build and clean step and
 executable chrome path in run.
 
 ## Debugger
 
-**You can skip the project settings and use QtCreator as a single file 
+**You can skip the project settings and use QtCreator as a single file
 standalone GDB frontend. **
 
 1. Tools - Options - Build & Run - Debuggers, make sure GDB is set.
-2. Tools - Options - Kits, change the Desktop kit to GDB(LLDB doesnot work in 
+2. Tools - Options - Kits, change the Desktop kit to GDB(LLDB doesnot work in
   Linux).
 3. Open file you want to debug.
-4. Debug - Start Debugging - Attach to running Application, you may need to 
+4. Debug - Start Debugging - Attach to running Application, you may need to
   open chrome's task manager to find the process number.
 
 ### Tips, tricks, and troubleshooting
@@ -114,5 +115,5 @@
 
 #### More
 
-See 
+See
 https://chromium.googlesource.com/chromium/src/+/master/docs/linux_debugging.md
\ No newline at end of file

diff --git a/docs/vscode.md b/docs/vscode.md
index e7252f1..d78d198 100644
--- a/docs/vscode.md
+++ b/docs/vscode.md

@@ -81,8 +81,8 @@
 
 ```
 $ git clone https://github.com/Valloric/ycmd.git ~/.ycmd
-$ git submodule update --init --recursive
 $ cd ~/.ycmd
+$ git submodule update --init --recursive
 $ ./build.py --clang-completer
 ```
 If it fails with "Your C++ compiler does NOT fully support C++11." but you know
@@ -541,4 +541,4 @@
 
 ### More
 More tips and tricks can be found
-[here](https://github.com/Microsoft/vscode-tips-and-tricks/blob/master/README.md).
\ No newline at end of file
+[here](https://github.com/Microsoft/vscode-tips-and-tricks/blob/master/README.md).

diff --git a/docs/webui_in_components.md b/docs/webui_in_components.md
new file mode 100644
index 0000000..2ba675f
--- /dev/null
+++ b/docs/webui_in_components.md

@@ -0,0 +1,318 @@
+<style>
+.note::before {
+  content: 'Note: ';
+  font-variant: small-caps;
+  font-style: italic;
+}
+
+.doc h1 {
+  margin: 0;
+}
+</style>
+
+# Creating WebUI Interfaces in `components/`
+
+To create a WebUI interface in `components/` you need to follow different steps from [Creating WebUI Interfaces in `chrome/`](https://www.chromium.org/developers/webui). This guide is specific to creating a WebUI interface in `src/components/`. It is based on the steps I went through to create the WebUI infrastructure for chrome://safe-browsing in 'src/components/safe_browsing/web_ui/'.
+
+[TOC]
+
+<a name="creating_webui_page"></a>
+## Creating the WebUI page
+
+WebUI resources in `components/` will be added in your specific project folder. Create a project folder `src/components/hello_world/`. When creating WebUI resources, follow the [Web Development Style Guide](https://chromium.googlesource.com/chromium/src/+/master/styleguide/web/web.md). For a sample WebUI page you could start with the following files:
+
+`src/components/hello_world/hello_world.html:`
+```html
+<!DOCTYPE HTML>
+<html i18n-values="dir:textdirection">
+<head>
+ <meta charset="utf-8">
+ <title i18n-content="helloWorldTitle"></title>
+ <link rel="stylesheet" href="hello_world.css">
+ <script src="chrome://resources/js/cr.js"></script>
+ <script src="chrome://resources/js/load_time_data.js"></script>
+ <script src="chrome://resources/js/util.js"></script>
+ <script src="strings.js"></script>
+ <script src="hello_world.js"></script>
+</head>
+<body i18n-values=".style.fontFamily:fontfamily;.style.fontSize:fontsize">
+  <h1 i18n-content="helloWorldTitle"></h1>
+  <p id="welcome-message"></p>
+<script src="chrome://resources/js/i18n_template.js"></script>
+</body>
+</html>
+```
+
+`src/components/hello_world/hello_world.css:`
+```css
+p {
+  white-space: pre-wrap;
+}
+```
+
+`src/components/hello_world/hello_world.js:`
+```js
+cr.define('hello_world', function() {
+  'use strict';
+
+  /**
+   * Be polite and insert translated hello world strings for the user on loading.
+   */
+  function initialize() {
+    $('welcome-message').textContent = loadTimeData.getStringF('welcomeMessage',
+        loadTimeData.getString('userName'));
+  }
+
+  // Return an object with all of the exports.
+  return {
+    initialize: initialize,
+  };
+});
+
+document.addEventListener('DOMContentLoaded', hello_world.initialize);
+```
+
+## Adding the resources
+
+Resource files are specified in a `.grdp` file. Here's our
+`components/resources/hello_world_resources.grdp`:
+
+```xml
+<?xml version="1.0" encoding="utf-8"?>
+<grit-part>
+  <include name="IDR_HELLO_WORLD_HTML" file="../../components/hello_world/hello_world.html" type="BINDATA" />
+  <include name="IDR_HELLO_WORLD_CSS" file="../../components/hello_world/hello_world.css" type="BINDATA" />
+  <include name="IDR_HELLO_WORLD_JS" file="../../components/hello_world/hello_world.js" type="BINDATA" />
+</grit-part>
+```
+
+## Adding URL constants for the new chrome URL
+
+Create the `constants.cc` and `constants.h` files to add the URL constants. This is where you will add the URL or URL's which will be directed to your new resources.
+
+`src/components/hello_world/constants.cc:`
+```c++
+const char kChromeUIHelloWorldURL[] = "chrome://hello-world/";
+const char kChromeUIHelloWorldHost[] = "hello-world";
+```
+
+`src/components/hello_world/constants.h:`
+```c++
+extern const char kChromeUIHelloWorldURL[];
+extern const char kChromeUIHelloWorldHost[];
+```
+
+## Adding localized strings
+
+We need a few string resources for translated strings to work on the new resource. The welcome message contains a variable with a sample value so that it can be accurately translated. Create a new file `components/hello_world_strings.grdp`. You can add the messages as follow:
+
+```xml
+<message name="IDS_HELLO_WORLD_TITLE" desc="A happy message saying hello to the world">
+  Hello World!
+</message>
+<message name="IDS_HELLO_WORLD_WELCOME_TEXT" desc="Message welcoming the user to the hello world page">
+  Welcome to this fancy Hello World page <ph name="WELCOME_NAME">$1<ex>Chromium User</ex></ph>!
+</message>
+```
+Add the created file in `components/components_strings.grd`:
+
+```xml
++<part file="hello_world_strings.grdp" />
+```
+
+## Adding a WebUI class for handling requests to the chrome://hello-world/ URL
+
+Next we need a class to handle requests to this new resource URL. Typically this will subclass `ChromeWebUI` (but WebUI dialogs should subclass `HtmlDialogUI` instead).
+
+`src/components/hello_world/hello_world_ui.h:`
+```c++
+#ifndef COMPONENTS_HELLO_WORLD_HELLO_WORLD_UI_H_
+#define COMPONENTS_HELLO_WORLD_HELLO_WORLD_UI_H_
+#pragma once
+
+#include "base/macros.h"
+#include "content/public/browser/web_ui_controller.h"
+
+// The WebUI for chrome://hello-world
+class HelloWorldUI : public content::WebUIController {
+ public:
+  explicit HelloWorldUI(content::WebUI* web_ui);
+  ~HelloWorldUI() override;
+ private:
+  DISALLOW_COPY_AND_ASSIGN(HelloWorldUI);
+};
+
+#endif  // COMPONENTS_HELLO_WORLD_HELLO_WORLD_UI_H_
+```
+
+`src/components/hello_world/hello_world_ui.cc:`
+```c++
+#include "components/hello_world/hello_world_ui.h"
+
+#include "components/grit/components_resources.h"
+#include "components/grit/components_scaled_resources.h"
+#include "components/hello_world/constants.h"
+#include "components/strings/grit/components_strings.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_ui.h"
+#include "content/public/browser/web_ui_data_source.h"
+
+HelloWorldUI::HelloWorldUI(content::WebUI* web_ui)
+    : content::WebUIController(web_ui) {
+  // Set up the chrome://hello-world source.
+  content::WebUIDataSource* html_source =
+      content::WebUIDataSource::Create(chrome::kChromeUIHelloWorldHost);
+
+  // Localized strings.
+  html_source->AddLocalizedString("helloWorldTitle", IDS_HELLO_WORLD_TITLE);
+  html_source->AddLocalizedString("welcomeMessage", IDS_HELLO_WORLD_WELCOME_TEXT);
+
+  // As a demonstration of passing a variable for JS to use we pass in the name "Bob".
+  html_source->AddString("userName", "Bob");
+  html_source->SetJsonPath("strings.js");
+
+  // Add required resources.
+  html_source->AddResourcePath("hello_world.css", IDR_HELLO_WORLD_CSS);
+  html_source->AddResourcePath("hello_world.js", IDR_HELLO_WORLD_JS);
+  html_source->SetDefaultResource(IDR_HELLO_WORLD_HTML);
+
+  content::BrowserContext* browser_context =
+      web_ui->GetWebContents()->GetBrowserContext();
+  content::WebUIDataSource::Add(browser_context, html_source);
+}
+
+HelloWorldUI::~HelloWorldUI() {
+}
+```
+
+## Adding new sources to Chrome
+
+In order for your new class to be built and linked, you need to update the `BUILD.gn` and DEPS files. Create
+
+`src/components/hello_world/BUILD.gn:`
+```
+sources = [
+  "hello_world_ui.cc",
+  "hello_world_ui.h",
+  ...
+```
+and `src/components/hello_world/DEPS:`
+```
+include_rules = [
+  "+components/grit/components_resources.h",
+  "+components/strings/grit/components_strings.h",
+  "+components/grit/components_scaled_resources.h"
+]
+```
+
+## Adding your WebUI request handler to the Chrome WebUI factory
+
+The Chrome WebUI factory is where you setup your new request handler.
+
+`src/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc:`
+```c++
++ #include "components/hello_world/hello_world_ui.h"
++ #include "components/hello_world/constants.h"
+...
++ if (url.host() == chrome::kChromeUIHelloWorldHost)
++   return &NewWebUI<HelloWorldUI>;
+```
+
+## Testing
+
+You're done! Assuming no errors (because everyone gets their code perfect the first time) you should be able to compile and run chrome and navigate to `chrome://hello-world/` and see your nifty welcome text!
+
+## Adding a callback handler
+
+You probably want your new WebUI page to be able to do something or get information from the C++ world. For this, we use message callback handlers. Let's say that we don't trust the Javascript engine to be able to add two integers together (since we know that it uses floating point values internally). We could add a callback handler to perform integer arithmetic for us.
+
+`src/components/hello_world/hello_world_ui.h:`
+```c++
+#include "content/public/browser/web_ui.h"
++
++ namespace base {
++   class ListValue;
++ }  // namespace base
+
+// The WebUI for chrome://hello-world
+...
+    // Set up the chrome://hello-world source.
+    content::WebUIDataSource* html_source = content::WebUIDataSource::Create(hello_world::kChromeUIHelloWorldHost);
++
++   // Register callback handler.
++   RegisterMessageCallback("addNumbers",
++       base::Bind(&HelloWorldUI::AddNumbers,
++                  base::Unretained(this)));
+
+    // Localized strings.
+...
+    virtual ~HelloWorldUI();
++
++  private:
++   // Add two numbers together using integer arithmetic.
++   void AddNumbers(const base::ListValue* args);
+
+    DISALLOW_COPY_AND_ASSIGN(HelloWorldUI);
+  };
+```
+
+`src/components/hello_world/hello_world_ui.cc:`
+```c++
+  #include "components/hello_world/hello_world_ui.h"
++
++ #include "base/values.h"
+  #include "content/public/browser/browser_context.h"
+...
+  HelloWorldUI::~HelloWorldUI() {
+  }
++
++ void HelloWorldUI::AddNumbers(const base::ListValue* args) {
++   int term1, term2;
++   if (!args->GetInteger(0, &term1) || !args->GetInteger(1, &term2))
++     return;
++   base::FundamentalValue result(term1 + term2);
++   AllowJavascript();
++   std::string callback_id;
++   args->GetString(0, &callback_id);
++   ResolveJavascriptCallback(base::Value(callback_id), result);
++ }
+```
+
+`src/components/hello_world/hello_world.js:`
+```c++
+    function initialize() {
++     cr.sendWithPromise('addNumbers', [2, 2]).then((result) =>
++         addResult(result));
+    }
++
++   function addResult(result) {
++     alert('The result of our C++ arithmetic: 2 + 2 = ' + result);
++   }
+
+    return {
+      initialize: initialize,
+    };
+```
+
+You'll notice that the call is asynchronous. We must wait for the C++ side to call our Javascript function to get the result.
+
+## Creating a WebUI Dialog
+
+Some pages have many messages or share code that sends messages. To make possible message handling and/or to create a WebUI dialogue `c++->js` and `js->c++`, follow the guide in [WebUI Explainer](https://chromium.googlesource.com/chromium/src/+/master/docs/webui_explainer.md).
+
+
+<script>
+let nameEls = Array.from(document.querySelectorAll('[id], a[name]'));
+let names = nameEls.map(nameEl => nameEl.name || nameEl.id);
+
+let localLinks = Array.from(document.querySelectorAll('a[href^="#"]'));
+let hrefs = localLinks.map(a => a.href.split('#')[1]);
+
+hrefs.forEach(href => {
+  if (names.includes(href))
+    console.info('found: ' + href);
+  else
+    console.error('broken href: ' + href);
+})
+</script>

diff --git a/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc b/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc
index 6fff29d..79c609a7 100644
--- a/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc
+++ b/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute.cc

@@ -22,6 +22,7 @@
 #include "extensions/browser/api/declarative_webrequest/request_stage.h"
 #include "extensions/browser/api/declarative_webrequest/webrequest_condition.h"
 #include "extensions/browser/api/declarative_webrequest/webrequest_constants.h"
+#include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/api/web_request/web_request_api_helpers.h"
 #include "extensions/browser/api/web_request/web_request_resource_type.h"
 #include "extensions/common/error_utils.h"
@@ -691,6 +692,9 @@
   std::string value;
   size_t iter = 0;
   while (!passed && headers->EnumerateHeaderLines(&iter, &name, &value)) {
+    if (ExtensionsAPIClient::Get()->ShouldHideResponseHeader(
+            request_data.request->url(), name))
+      continue;
     passed |= header_matcher_->TestNameValue(name, value);
   }
 

diff --git a/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute_unittest.cc b/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute_unittest.cc
index 77e9b1af..b3c663e 100644
--- a/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute_unittest.cc
+++ b/extensions/browser/api/declarative_webrequest/webrequest_condition_attribute_unittest.cc

@@ -19,12 +19,14 @@
 #include "content/public/common/previews_state.h"
 #include "extensions/browser/api/declarative_webrequest/webrequest_condition.h"
 #include "extensions/browser/api/declarative_webrequest/webrequest_constants.h"
+#include "extensions/browser/api/extensions_api_client.h"
 #include "net/base/request_priority.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
 
 using base::DictionaryValue;
 using base::ListValue;
@@ -531,6 +533,7 @@
 // 2. Performing logical disjunction (||) between multiple specifications.
 // 3. Negating the match in case of 'doesNotContainHeaders'.
 TEST(WebRequestConditionAttributeTest, ResponseHeaders) {
+  ExtensionsAPIClient api_client;
   // Necessary for TestURLRequest.
   base::MessageLoopForIO message_loop;
 
@@ -723,5 +726,70 @@
   EXPECT_FALSE(result);
 }
 
+TEST(WebRequestConditionAttributeTest, HideResponseHeaders) {
+  // Necessary for TestURLRequest.
+  base::MessageLoopForIO message_loop;
+
+  net::EmbeddedTestServer test_server;
+  test_server.ServeFilesFromDirectory(TestDataPath(
+      "chrome/test/data/extensions/api_test/webrequest/declarative"));
+  ASSERT_TRUE(test_server.Start());
+
+  net::TestURLRequestContext context;
+  net::TestDelegate delegate;
+  GURL url = test_server.GetURL("/headers.html");
+  std::unique_ptr<net::URLRequest> url_request(context.CreateRequest(
+      url, net::DEFAULT_PRIORITY, &delegate, TRAFFIC_ANNOTATION_FOR_TESTS));
+  url_request->Start();
+  base::RunLoop().Run();
+
+  // In all the test below we assume that the server includes the headers
+  // Custom-Header: custom/value
+  // Custom-Header-B: valueA
+  // Custom-Header-B: valueB
+  // Custom-Header-C: valueC, valueD
+  // Custom-Header-D:
+
+  std::vector<std::vector<const std::string*>> tests;
+  bool result;
+  const RequestStage stage = ON_HEADERS_RECEIVED;
+  const std::string kCondition[] = {keys::kValueEqualsKey, "custom/value"};
+  const size_t kConditionSizes[] = {arraysize(kCondition)};
+  GetArrayAsVector(kCondition, kConditionSizes, 1u, &tests);
+
+  {
+    // Default client does not hide the response header.
+    ExtensionsAPIClient api_client;
+    MatchAndCheck(tests, keys::kResponseHeadersKey, stage, url_request.get(),
+                  &result);
+    EXPECT_TRUE(result);
+  }
+
+  {
+    // Custom client hides the response header.
+    class TestExtensionsAPIClient : public ExtensionsAPIClient {
+     public:
+      TestExtensionsAPIClient(const GURL& url) : url_(url) {}
+
+     private:
+      bool ShouldHideResponseHeader(
+          const GURL& url,
+          const std::string& header_name) const override {
+        // Check that the client is called with the right URL.
+        EXPECT_EQ(url_, url);
+        // Hide the header.
+        return header_name == "Custom-Header";
+      }
+
+      GURL url_;
+    };
+
+    TestExtensionsAPIClient api_client(url);
+    MatchAndCheck(tests, keys::kResponseHeadersKey, stage, url_request.get(),
+                  &result);
+    EXPECT_FALSE(result);
+  }
+}
+
 }  // namespace
 }  // namespace extensions

diff --git a/extensions/browser/api/extensions_api_client.cc b/extensions/browser/api/extensions_api_client.cc
index 8cb900dc..3d8faf3 100644
--- a/extensions/browser/api/extensions_api_client.cc
+++ b/extensions/browser/api/extensions_api_client.cc

@@ -38,6 +38,12 @@
     content::WebContents* web_contents) const {
 }
 
+bool ExtensionsAPIClient::ShouldHideResponseHeader(
+    const GURL& url,
+    const std::string& header_name) const {
+  return false;
+}
+
 AppViewGuestDelegate* ExtensionsAPIClient::CreateAppViewGuestDelegate() const {
   return NULL;
 }

diff --git a/extensions/browser/api/extensions_api_client.h b/extensions/browser/api/extensions_api_client.h
index 133a014..8a02d78 100644
--- a/extensions/browser/api/extensions_api_client.h
+++ b/extensions/browser/api/extensions_api_client.h

@@ -7,6 +7,8 @@
 
 #include <map>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "extensions/browser/api/clipboard/clipboard_api.h"
@@ -14,6 +16,8 @@
 #include "extensions/browser/api/storage/settings_namespace.h"
 #include "extensions/common/api/clipboard.h"
 
+class GURL;
+
 namespace base {
 template <class T>
 class ObserverListThreadSafe;
@@ -85,6 +89,10 @@
   virtual void AttachWebContentsHelpers(content::WebContents* web_contents)
       const;
 
+  // Returns true if the header should be hidden to extensions.
+  virtual bool ShouldHideResponseHeader(const GURL& url,
+                                        const std::string& header_name) const;
+
   // Creates the AppViewGuestDelegate.
   virtual AppViewGuestDelegate* CreateAppViewGuestDelegate() const;
 

diff --git a/extensions/browser/api/web_request/web_request_api.cc b/extensions/browser/api/web_request/web_request_api.cc
index 5bf78370..1b7b86d 100644
--- a/extensions/browser/api/web_request/web_request_api.cc
+++ b/extensions/browser/api/web_request/web_request_api.cc

@@ -1602,12 +1602,9 @@
       helpers::ResponseHeaders* new_headers =
           response->response_headers.get();
       return helpers::CalculateOnHeadersReceivedDelta(
-          response->extension_id,
-          response->extension_install_time,
-          response->cancel,
-          response->new_url,
-          old_headers,
-          new_headers);
+          response->extension_id, response->extension_install_time,
+          response->cancel, blocked_request->request->url(), response->new_url,
+          old_headers, new_headers);
     }
     case ExtensionWebRequestEventRouter::kOnAuthRequired:
       return helpers::CalculateOnAuthRequiredDelta(

diff --git a/extensions/browser/api/web_request/web_request_api_helpers.cc b/extensions/browser/api/web_request/web_request_api_helpers.cc
index d29ff45..1c5d9d4 100644
--- a/extensions/browser/api/web_request/web_request_api_helpers.cc
+++ b/extensions/browser/api/web_request/web_request_api_helpers.cc

@@ -22,6 +22,7 @@
 #include "components/web_cache/browser/web_cache_manager.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
+#include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/api/web_request/web_request_api_constants.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_system.h"
@@ -329,6 +330,7 @@
     const std::string& extension_id,
     const base::Time& extension_install_time,
     bool cancel,
+    const GURL& old_url,
     const GURL& new_url,
     const net::HttpResponseHeaders* old_response_headers,
     ResponseHeaders* new_response_headers) {
@@ -340,14 +342,18 @@
   if (!new_response_headers)
     return result;
 
+  extensions::ExtensionsAPIClient* api_client =
+      extensions::ExtensionsAPIClient::Get();
+
   // Find deleted headers (header keys are treated case insensitively).
   {
     size_t iter = 0;
     std::string name;
     std::string value;
     while (old_response_headers->EnumerateHeaderLines(&iter, &name, &value)) {
+      if (api_client->ShouldHideResponseHeader(old_url, name))
+        continue;
       std::string name_lowercase = base::ToLowerASCII(name);
-
       bool header_found = false;
       for (const auto& i : *new_response_headers) {
         if (base::LowerCaseEqualsASCII(i.first, name_lowercase) &&
@@ -364,6 +370,8 @@
   // Find added headers (header keys are treated case insensitively).
   {
     for (const auto& i : *new_response_headers) {
+      if (api_client->ShouldHideResponseHeader(old_url, i.first))
+        continue;
       std::string name_lowercase = base::ToLowerASCII(i.first);
       size_t iter = 0;
       std::string name;

diff --git a/extensions/browser/api/web_request/web_request_api_helpers.h b/extensions/browser/api/web_request/web_request_api_helpers.h
index 5542c88..1faac8ee 100644
--- a/extensions/browser/api/web_request/web_request_api_helpers.h
+++ b/extensions/browser/api/web_request/web_request_api_helpers.h

@@ -11,6 +11,8 @@
 #include <memory>
 #include <set>
 #include <string>
+#include <utility>
+#include <vector>
 
 #include "base/macros.h"
 #include "base/memory/linked_ptr.h"
@@ -232,6 +234,7 @@
     const std::string& extension_id,
     const base::Time& extension_install_time,
     bool cancel,
+    const GURL& old_url,
     const GURL& new_url,
     const net::HttpResponseHeaders* old_response_headers,
     ResponseHeaders* new_response_headers);

diff --git a/extensions/browser/api/web_request/web_request_event_details.cc b/extensions/browser/api/web_request/web_request_event_details.cc
index f0b07bf..c89edeb 100644
--- a/extensions/browser/api/web_request/web_request_event_details.cc
+++ b/extensions/browser/api/web_request/web_request_event_details.cc

@@ -5,6 +5,7 @@
 #include "extensions/browser/api/web_request/web_request_event_details.h"
 
 #include <utility>
+#include <vector>
 
 #include "base/callback.h"
 #include "base/memory/ptr_util.h"
@@ -14,6 +15,7 @@
 #include "content/public/browser/resource_request_info.h"
 #include "content/public/browser/websocket_handshake_request_info.h"
 #include "content/public/common/child_process_host.h"
+#include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/api/web_request/upload_data_presenter.h"
 #include "extensions/browser/api/web_request/web_request_api_constants.h"
 #include "extensions/browser/api/web_request/web_request_api_helpers.h"
@@ -154,8 +156,13 @@
       size_t iter = 0;
       std::string name;
       std::string value;
-      while (response_headers->EnumerateHeaderLines(&iter, &name, &value))
+      while (response_headers->EnumerateHeaderLines(&iter, &name, &value)) {
+        if (ExtensionsAPIClient::Get()->ShouldHideResponseHeader(request->url(),
+                                                                 name)) {
+          continue;
+        }
         headers->Append(helpers::CreateHeaderDictionary(name, value));
+      }
     }
     response_headers_.reset(headers);
   }

diff --git a/gpu/command_buffer/service/BUILD.gn b/gpu/command_buffer/service/BUILD.gn
index c3f63e3..458eea92 100644
--- a/gpu/command_buffer/service/BUILD.gn
+++ b/gpu/command_buffer/service/BUILD.gn

@@ -44,6 +44,8 @@
     "context_state.h",
     "context_state_autogen.h",
     "context_state_impl_autogen.h",
+    "create_gr_gl_interface.cc",
+    "create_gr_gl_interface.h",
     "error_state.cc",
     "error_state.h",
     "feature_info.cc",

diff --git a/gpu/command_buffer/service/create_gr_gl_interface.cc b/gpu/command_buffer/service/create_gr_gl_interface.cc
new file mode 100644
index 0000000..08c3c64
--- /dev/null
+++ b/gpu/command_buffer/service/create_gr_gl_interface.cc

@@ -0,0 +1,490 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "gpu/command_buffer/service/create_gr_gl_interface.h"
+#include "ui/gl/gl_bindings.h"
+#include "ui/gl/gl_version_info.h"
+
+namespace gpu {
+namespace gles2 {
+
+namespace {
+
+const GLubyte* GetStringHook(const char* version_string, GLenum name) {
+  switch (name) {
+    case GL_VERSION:
+      return reinterpret_cast<const GLubyte*>(version_string);
+    default:
+      return glGetString(name);
+  }
+}
+
+const char* kBlacklistExtensions[] = {
+    "GL_APPLE_framebuffer_multisample",
+    "GL_APPLE_sync",
+    "GL_ARB_ES3_1_compatibility",
+    "GL_ARB_draw_indirect",
+    "GL_ARB_invalidate_subdata",
+    "GL_ARB_multi_draw_indirect",
+    "GL_ARB_sample_shading",
+    "GL_ARB_texture_barrier",
+    "GL_EXT_direct_state_access",
+    "GL_EXT_multi_draw_indirect",
+    "GL_EXT_raster_multisample",
+    "GL_EXT_window_rectangles",
+    "GL_NV_bindless_texture",
+    "GL_NV_texture_barrier",
+    "GL_OES_sample_shading",
+};
+
+}  // anonymous namespace
+
+sk_sp<const GrGLInterface> CreateGrGLInterface(
+    const gl::GLVersionInfo& version_info) {
+  gl::ProcsGL* gl = &gl::g_current_gl_driver->fn;
+
+  GrGLStandard standard =
+      version_info.is_es ? kGLES_GrGLStandard : kGL_GrGLStandard;
+
+  // Depending on the advertised version and extensions, skia checks for
+  // existence of entrypoints. However some of those we don't yet handle in
+  // gl_bindings, so we need to fake the version to the maximum fully supported
+  // by the bindings (GL 3.2 or ES 3.0), and blacklist extensions that skia
+  // handles but bindings don't.
+  // TODO(piman): add bindings for missing entrypoints.
+  GrGLFunction<GrGLGetStringProc> get_string;
+  if (version_info.IsAtLeastGL(3, 3) || version_info.IsAtLeastGLES(3, 1)) {
+    const char* fake_version = version_info.is_es ? "OpenGL ES 3.0" : "3.2";
+    get_string = [fake_version](GLenum name) {
+      return GetStringHook(fake_version, name);
+    };
+  } else {
+    get_string = gl->glGetStringFn;
+  }
+
+  GrGLExtensions extensions;
+  if (!extensions.init(standard, get_string, gl->glGetStringiFn,
+                       gl->glGetIntegervFn)) {
+    LOG(ERROR) << "Failed to initialize extensions";
+    return nullptr;
+  }
+  for (const char* extension : kBlacklistExtensions)
+    extensions.remove(extension);
+
+  GrGLInterface* interface = new GrGLInterface();
+  GrGLInterface::Functions* functions = &interface->fFunctions;
+  functions->fActiveTexture = gl->glActiveTextureFn;
+  functions->fAttachShader = gl->glAttachShaderFn;
+  functions->fBindAttribLocation = gl->glBindAttribLocationFn;
+  functions->fBindBuffer = gl->glBindBufferFn;
+  functions->fBindFragDataLocation = gl->glBindFragDataLocationFn;
+  functions->fBeginQuery = gl->glBeginQueryFn;
+  functions->fBindTexture = gl->glBindTextureFn;
+
+  functions->fBlendBarrier = gl->glBlendBarrierKHRFn;
+
+  functions->fBlendColor = gl->glBlendColorFn;
+  functions->fBlendEquation = gl->glBlendEquationFn;
+  functions->fBlendFunc = gl->glBlendFuncFn;
+  functions->fBufferData = gl->glBufferDataFn;
+  functions->fBufferSubData = gl->glBufferSubDataFn;
+  functions->fClear = gl->glClearFn;
+  functions->fClearColor = gl->glClearColorFn;
+  functions->fClearStencil = gl->glClearStencilFn;
+
+  // Not used
+  // functions->fClearTexImage = nullptr;
+  // functions->fClearTexSubImage = nullptr;
+
+  functions->fColorMask = gl->glColorMaskFn;
+  functions->fCompileShader = gl->glCompileShaderFn;
+  functions->fCompressedTexImage2D = gl->glCompressedTexImage2DFn;
+  functions->fCompressedTexSubImage2D = gl->glCompressedTexSubImage2DFn;
+  functions->fCopyTexSubImage2D = gl->glCopyTexSubImage2DFn;
+  functions->fCreateProgram = gl->glCreateProgramFn;
+  functions->fCreateShader = gl->glCreateShaderFn;
+  functions->fCullFace = gl->glCullFaceFn;
+  functions->fDeleteBuffers = gl->glDeleteBuffersARBFn;
+  functions->fDeleteProgram = gl->glDeleteProgramFn;
+  functions->fDeleteQueries = gl->glDeleteQueriesFn;
+  functions->fDeleteShader = gl->glDeleteShaderFn;
+  functions->fDeleteTextures = gl->glDeleteTexturesFn;
+  functions->fDepthMask = gl->glDepthMaskFn;
+  functions->fDisable = gl->glDisableFn;
+  functions->fDisableVertexAttribArray = gl->glDisableVertexAttribArrayFn;
+  functions->fDrawArrays = gl->glDrawArraysFn;
+  functions->fDrawBuffer = gl->glDrawBufferFn;
+  functions->fDrawBuffers = gl->glDrawBuffersARBFn;
+  functions->fDrawElements = gl->glDrawElementsFn;
+
+  functions->fDrawArraysInstanced = gl->glDrawArraysInstancedANGLEFn;
+  functions->fDrawElementsInstanced = gl->glDrawElementsInstancedANGLEFn;
+
+  // GL 4.0 or GL_ARB_draw_indirect or ES 3.1
+  // functions->fDrawArraysIndirect = gl->glDrawArraysIndirectFn;
+  // functions->fDrawElementsIndirect = gl->glDrawElementsIndirectFn;
+
+  functions->fDrawRangeElements = gl->glDrawRangeElementsFn;
+  functions->fEnable = gl->glEnableFn;
+  functions->fEnableVertexAttribArray = gl->glEnableVertexAttribArrayFn;
+  functions->fEndQuery = gl->glEndQueryFn;
+  functions->fFinish = gl->glFinishFn;
+  functions->fFlush = gl->glFlushFn;
+  functions->fFrontFace = gl->glFrontFaceFn;
+  functions->fGenBuffers = gl->glGenBuffersARBFn;
+  functions->fGetBufferParameteriv = gl->glGetBufferParameterivFn;
+  functions->fGetError = gl->glGetErrorFn;
+  functions->fGetIntegerv = gl->glGetIntegervFn;
+  functions->fGetMultisamplefv = gl->glGetMultisamplefvFn;
+  functions->fGetQueryObjectiv = gl->glGetQueryObjectivFn;
+  functions->fGetQueryObjectuiv = gl->glGetQueryObjectuivFn;
+  functions->fGetQueryObjecti64v = gl->glGetQueryObjecti64vFn;
+  functions->fGetQueryObjectui64v = gl->glGetQueryObjectui64vFn;
+  functions->fQueryCounter = gl->glQueryCounterFn;
+  functions->fGetQueryiv = gl->glGetQueryivFn;
+  functions->fGetProgramInfoLog = gl->glGetProgramInfoLogFn;
+  functions->fGetProgramiv = gl->glGetProgramivFn;
+  functions->fGetShaderInfoLog = gl->glGetShaderInfoLogFn;
+  functions->fGetShaderiv = gl->glGetShaderivFn;
+  functions->fGetString = get_string;
+  functions->fGetStringi = gl->glGetStringiFn;
+  functions->fGetShaderPrecisionFormat = gl->glGetShaderPrecisionFormatFn;
+  functions->fGetTexLevelParameteriv = gl->glGetTexLevelParameterivFn;
+  functions->fGenQueries = gl->glGenQueriesFn;
+  functions->fGenTextures = gl->glGenTexturesFn;
+  functions->fGetUniformLocation = gl->glGetUniformLocationFn;
+  functions->fIsTexture = gl->glIsTextureFn;
+  functions->fLineWidth = gl->glLineWidthFn;
+  functions->fLinkProgram = gl->glLinkProgramFn;
+  functions->fMapBuffer = gl->glMapBufferFn;
+
+  // GL 4.3 or GL_ARB_multi_draw_indirect or ES+GL_EXT_multi_draw_indirect
+  // functions->fMultiDrawArraysIndirect = gl->glMultiDrawArraysIndirectFn;
+  // functions->fMultiDrawElementsIndirect = gl->glMultiDrawElementsIndirectFn;
+
+  functions->fPixelStorei = gl->glPixelStoreiFn;
+  functions->fPolygonMode = gl->glPolygonModeFn;
+
+  // GL_EXT_raster_multisample
+  // functions->fRasterSamples = gl->glRasterSamplesEXTFn;
+
+  functions->fReadBuffer = gl->glReadBufferFn;
+  functions->fReadPixels = gl->glReadPixelsFn;
+  functions->fScissor = gl->glScissorFn;
+  functions->fShaderSource = gl->glShaderSourceFn;
+  functions->fStencilFunc = gl->glStencilFuncFn;
+  functions->fStencilFuncSeparate = gl->glStencilFuncSeparateFn;
+  functions->fStencilMask = gl->glStencilMaskFn;
+  functions->fStencilMaskSeparate = gl->glStencilMaskSeparateFn;
+  functions->fStencilOp = gl->glStencilOpFn;
+  functions->fStencilOpSeparate = gl->glStencilOpSeparateFn;
+  functions->fTexBuffer = gl->glTexBufferFn;
+  functions->fTexBufferRange = gl->glTexBufferRangeFn;
+  functions->fTexImage2D = gl->glTexImage2DFn;
+  functions->fTexParameteri = gl->glTexParameteriFn;
+  functions->fTexParameteriv = gl->glTexParameterivFn;
+  functions->fTexStorage2D = gl->glTexStorage2DEXTFn;
+  functions->fTexSubImage2D = gl->glTexSubImage2DFn;
+
+  // GL 4.5 or GL_ARB_texture_barrier or GL_NV_texture_barrier
+  // functions->fTextureBarrier = gl->glTextureBarrierFn;
+  // functions->fTextureBarrier = gl->glTextureBarrierNVFn;
+
+  functions->fUniform1f = gl->glUniform1fFn;
+  functions->fUniform1i = gl->glUniform1iFn;
+  functions->fUniform1fv = gl->glUniform1fvFn;
+  functions->fUniform1iv = gl->glUniform1ivFn;
+  functions->fUniform2f = gl->glUniform2fFn;
+  functions->fUniform2i = gl->glUniform2iFn;
+  functions->fUniform2fv = gl->glUniform2fvFn;
+  functions->fUniform2iv = gl->glUniform2ivFn;
+  functions->fUniform3f = gl->glUniform3fFn;
+  functions->fUniform3i = gl->glUniform3iFn;
+  functions->fUniform3fv = gl->glUniform3fvFn;
+  functions->fUniform3iv = gl->glUniform3ivFn;
+  functions->fUniform4f = gl->glUniform4fFn;
+  functions->fUniform4i = gl->glUniform4iFn;
+  functions->fUniform4fv = gl->glUniform4fvFn;
+  functions->fUniform4iv = gl->glUniform4ivFn;
+  functions->fUniformMatrix2fv = gl->glUniformMatrix2fvFn;
+  functions->fUniformMatrix3fv = gl->glUniformMatrix3fvFn;
+  functions->fUniformMatrix4fv = gl->glUniformMatrix4fvFn;
+  functions->fUnmapBuffer = gl->glUnmapBufferFn;
+  functions->fUseProgram = gl->glUseProgramFn;
+  functions->fVertexAttrib1f = gl->glVertexAttrib1fFn;
+  functions->fVertexAttrib2fv = gl->glVertexAttrib2fvFn;
+  functions->fVertexAttrib3fv = gl->glVertexAttrib3fvFn;
+  functions->fVertexAttrib4fv = gl->glVertexAttrib4fvFn;
+
+  functions->fVertexAttribDivisor = gl->glVertexAttribDivisorANGLEFn;
+
+  functions->fVertexAttribIPointer = gl->glVertexAttribIPointerFn;
+
+  functions->fVertexAttribPointer = gl->glVertexAttribPointerFn;
+  functions->fViewport = gl->glViewportFn;
+  functions->fBindFragDataLocationIndexed = gl->glBindFragDataLocationIndexedFn;
+
+  functions->fBindVertexArray = gl->glBindVertexArrayOESFn;
+  functions->fGenVertexArrays = gl->glGenVertexArraysOESFn;
+  functions->fDeleteVertexArrays = gl->glDeleteVertexArraysOESFn;
+
+  functions->fMapBufferRange = gl->glMapBufferRangeFn;
+  functions->fFlushMappedBufferRange = gl->glFlushMappedBufferRangeFn;
+
+  functions->fGenerateMipmap = gl->glGenerateMipmapEXTFn;
+  functions->fGenFramebuffers = gl->glGenFramebuffersEXTFn;
+  functions->fGetFramebufferAttachmentParameteriv =
+      gl->glGetFramebufferAttachmentParameterivEXTFn;
+  functions->fGetRenderbufferParameteriv =
+      gl->glGetRenderbufferParameterivEXTFn;
+  functions->fBindFramebuffer = gl->glBindFramebufferEXTFn;
+  functions->fFramebufferTexture2D = gl->glFramebufferTexture2DEXTFn;
+  functions->fCheckFramebufferStatus = gl->glCheckFramebufferStatusEXTFn;
+  functions->fDeleteFramebuffers = gl->glDeleteFramebuffersEXTFn;
+  functions->fRenderbufferStorage = gl->glRenderbufferStorageEXTFn;
+  functions->fGenRenderbuffers = gl->glGenRenderbuffersEXTFn;
+  functions->fDeleteRenderbuffers = gl->glDeleteRenderbuffersEXTFn;
+  functions->fFramebufferRenderbuffer = gl->glFramebufferRenderbufferEXTFn;
+  functions->fBindRenderbuffer = gl->glBindRenderbufferEXTFn;
+  functions->fRenderbufferStorageMultisample =
+      gl->glRenderbufferStorageMultisampleEXTFn;
+  functions->fBlitFramebuffer = gl->glBlitFramebufferFn;
+
+  functions->fMatrixLoadf = gl->glMatrixLoadfEXTFn;
+  functions->fMatrixLoadIdentity = gl->glMatrixLoadIdentityEXTFn;
+  functions->fPathCommands = gl->glPathCommandsNVFn;
+  functions->fPathParameteri = gl->glPathParameteriNVFn;
+  functions->fPathParameterf = gl->glPathParameterfNVFn;
+  functions->fGenPaths = gl->glGenPathsNVFn;
+  functions->fDeletePaths = gl->glDeletePathsNVFn;
+  functions->fIsPath = gl->glIsPathNVFn;
+  functions->fPathStencilFunc = gl->glPathStencilFuncNVFn;
+  functions->fStencilFillPath = gl->glStencilFillPathNVFn;
+  functions->fStencilStrokePath = gl->glStencilStrokePathNVFn;
+  functions->fStencilFillPathInstanced = gl->glStencilFillPathInstancedNVFn;
+  functions->fStencilStrokePathInstanced = gl->glStencilStrokePathInstancedNVFn;
+  functions->fCoverFillPath = gl->glCoverFillPathNVFn;
+  functions->fCoverStrokePath = gl->glCoverStrokePathNVFn;
+  functions->fCoverFillPathInstanced = gl->glCoverFillPathInstancedNVFn;
+  functions->fCoverStrokePathInstanced = gl->glCoverStrokePathInstancedNVFn;
+  functions->fStencilThenCoverFillPath = gl->glStencilThenCoverFillPathNVFn;
+  functions->fStencilThenCoverStrokePath = gl->glStencilThenCoverStrokePathNVFn;
+  functions->fStencilThenCoverFillPathInstanced =
+      gl->glStencilThenCoverFillPathInstancedNVFn;
+  functions->fStencilThenCoverStrokePathInstanced =
+      gl->glStencilThenCoverStrokePathInstancedNVFn;
+  functions->fProgramPathFragmentInputGen =
+      gl->glProgramPathFragmentInputGenNVFn;
+
+  functions->fCoverageModulation = gl->glCoverageModulationNVFn;
+
+  functions->fInsertEventMarker = gl->glInsertEventMarkerEXTFn;
+  functions->fPushGroupMarker = gl->glPushGroupMarkerEXTFn;
+  functions->fPopGroupMarker = gl->glPopGroupMarkerEXTFn;
+
+  // GL 4.3 or GL_ARB_invalidate_subdata
+  // functions->fInvalidateBufferData = gl->glInvalidateBufferDataFn;
+  // functions->fInvalidateBufferSubData = gl->glInvalidateBufferSubDataFn;
+  // functions->fInvalidateTexImage = gl->glInvalidateTexImageFn;
+  // functions->fInvalidateTexSubImage = gl->glInvalidateTexSubImageFn;
+
+  functions->fInvalidateFramebuffer = gl->glInvalidateFramebufferFn;
+  functions->fInvalidateSubFramebuffer = gl->glInvalidateSubFramebufferFn;
+
+  functions->fGetProgramResourceLocation = gl->glGetProgramResourceLocationFn;
+
+  // GL_NV_bindless_texture
+  // functions->fGetTextureHandle = gl->glGetTextureHandleNVFn;
+  // functions->fGetTextureSamplerHandle = gl->glGetTextureSamplerHandleNVFn;
+  // functions->fMakeTextureHandleResident =
+  //     gl->glMakeTextureHandleResidentNVFn;
+  // functions->fMakeTextureHandleNonResident =
+  //     gl->glMakeTextureHandleNonResidentNVFn;
+  // functions->fGetImageHandle = gl->glGetImageHandleNVFn;
+  // functions->fMakeImageHandleResident = gl->glMakeImageHandleResidentNVFn;
+  // functions->fMakeImageHandleNonResident =
+  //     gl->glMakeImageHandleNonResidentNVFn;
+  // functions->fIsTextureHandleResident = gl->glIsTextureHandleResidentNVFn;
+  // functions->fIsImageHandleResident = gl->glIsImageHandleResidentNVFn;
+  // functions->fUniformHandleui64 = gl->glUniformHandleui64NVFn;
+  // functions->fUniformHandleui64v = gl->glUniformHandleui64vNVFn;
+  // functions->fProgramUniformHandleui64 = gl->glProgramUniformHandleui64NVFn;
+  // functions->fProgramUniformHandleui64v =
+  //     gl->glProgramUniformHandleui64vNVFn;
+
+  // GL_EXT_direct_state_access
+  // functions->fTextureParameteri = gl->glTextureParameteriEXTFn;
+  // functions->fTextureParameteriv = gl->glTextureParameterivEXTFn;
+  // functions->fTextureParameterf = gl->glTextureParameterfEXTFn;
+  // functions->fTextureParameterfv = gl->glTextureParameterfvEXTFn;
+  // functions->fTextureImage1D = gl->glTextureImage1DEXTFn;
+  // functions->fTextureImage2D = gl->glTextureImage2DEXTFn;
+  // functions->fTextureSubImage1D = gl->glTextureSubImage1DEXTFn;
+  // functions->fTextureSubImage2D = gl->glTextureSubImage2DEXTFn;
+  // functions->fCopyTextureImage1D = gl->glCopyTextureImage1DEXTFn;
+  // functions->fCopyTextureImage2D = gl->glCopyTextureImage2DEXTFn;
+  // functions->fCopyTextureSubImage1D = gl->glCopyTextureSubImage1DEXTFn;
+  // functions->fCopyTextureSubImage2D = gl->glCopyTextureSubImage2DEXTFn;
+  // functions->fGetNamedBufferParameteriv =
+  //     gl->glGetNamedBufferParameterivEXTFn;
+  // functions->fGetNamedBufferPointerv = gl->glGetNamedBufferPointervEXTFn;
+  // functions->fGetNamedBufferSubData = gl->glGetNamedBufferSubDataEXTFn;
+  // functions->fGetTextureImage = gl->glGetTextureImageEXTFn;
+  // functions->fGetTextureParameterfv = gl->glGetTextureParameterfvEXTFn;
+  // functions->fGetTextureParameteriv = gl->glGetTextureParameterivEXTFn;
+  // functions->fGetTextureLevelParameterfv =
+  //     gl->glGetTextureLevelParameterfvEXTFn;
+  // functions->fGetTextureLevelParameteriv =
+  //     gl->glGetTextureLevelParameterivEXTFn;
+  // functions->fMapNamedBuffer = gl->glMapNamedBufferEXTFn;
+  // functions->fNamedBufferData = gl->glNamedBufferDataEXTFn;
+  // functions->fNamedBufferSubData = gl->glNamedBufferSubDataEXTFn;
+  // functions->fProgramUniform1f = gl->glProgramUniform1fEXTFn;
+  // functions->fProgramUniform2f = gl->glProgramUniform2fEXTFn;
+  // functions->fProgramUniform3f = gl->glProgramUniform3fEXTFn;
+  // functions->fProgramUniform4f = gl->glProgramUniform4fEXTFn;
+  // functions->fProgramUniform1i = gl->glProgramUniform1iEXTFn;
+  // functions->fProgramUniform2i = gl->glProgramUniform2iEXTFn;
+  // functions->fProgramUniform3i = gl->glProgramUniform3iEXTFn;
+  // functions->fProgramUniform4i = gl->glProgramUniform4iEXTFn;
+  // functions->fProgramUniform1fv = gl->glProgramUniform1fvEXTFn;
+  // functions->fProgramUniform2fv = gl->glProgramUniform2fvEXTFn;
+  // functions->fProgramUniform3fv = gl->glProgramUniform3fvEXTFn;
+  // functions->fProgramUniform4fv = gl->glProgramUniform4fvEXTFn;
+  // functions->fProgramUniform1iv = gl->glProgramUniform1ivEXTFn;
+  // functions->fProgramUniform2iv = gl->glProgramUniform2ivEXTFn;
+  // functions->fProgramUniform3iv = gl->glProgramUniform3ivEXTFn;
+  // functions->fProgramUniform4iv = gl->glProgramUniform4ivEXTFn;
+  // functions->fProgramUniformMatrix2fv = gl->glProgramUniformMatrix2fvEXTFn;
+  // functions->fProgramUniformMatrix3fv = gl->glProgramUniformMatrix3fvEXTFn;
+  // functions->fProgramUniformMatrix4fv = gl->glProgramUniformMatrix4fvEXTFn;
+  // functions->fUnmapNamedBuffer = gl->glUnmapNamedBufferEXTFn;
+  // functions->fTextureImage3D = gl->glTextureImage3DEXTFn;
+  // functions->fTextureSubImage3D = gl->glTextureSubImage3DEXTFn;
+  // functions->fCopyTextureSubImage3D = gl->glCopyTextureSubImage3DEXTFn;
+  // functions->fCompressedTextureImage3D = gl->glCompressedTextureImage3DEXTFn;
+  // functions->fCompressedTextureImage2D = gl->glCompressedTextureImage2DEXTFn;
+  // functions->fCompressedTextureImage1D = gl->glCompressedTextureImage1DEXTFn;
+  // functions->fCompressedTextureSubImage3D =
+  //     gl->glCompressedTextureSubImage3DEXTFn;
+  // functions->fCompressedTextureSubImage2D =
+  //     gl->glCompressedTextureSubImage2DEXTFn;
+  // functions->fCompressedTextureSubImage1D =
+  //     gl->glCompressedTextureSubImage1DEXTFn;
+  // functions->fGetCompressedTextureImage =
+  //     gl->glGetCompressedTextureImageEXTFn;
+  // functions->fProgramUniformMatrix2x3fv =
+  //     gl->glProgramUniformMatrix2x3fvEXTFn;
+  // functions->fProgramUniformMatrix3x2fv =
+  //     gl->glProgramUniformMatrix3x2fvEXTFn;
+  // functions->fProgramUniformMatrix2x4fv =
+  //     gl->glProgramUniformMatrix2x4fvEXTFn;
+  // functions->fProgramUniformMatrix4x2fv =
+  //     gl->glProgramUniformMatrix4x2fvEXTFn;
+  // functions->fProgramUniformMatrix3x4fv =
+  //     gl->glProgramUniformMatrix3x4fvEXTFn;
+  // functions->fProgramUniformMatrix4x3fv =
+  //     gl->glProgramUniformMatrix4x3fvEXTFn;
+  // functions->fNamedRenderbufferStorage = gl->glNamedRenderbufferStorageEXTFn;
+  // functions->fGetNamedRenderbufferParameteriv =
+  //     gl->glGetNamedRenderbufferParameterivEXTFn;
+  // functions->fNamedRenderbufferStorageMultisample =
+  //     gl->glNamedRenderbufferStorageMultisampleEXTFn;
+  // functions->fCheckNamedFramebufferStatus =
+  //     gl->glCheckNamedFramebufferStatusEXTFn;
+  // functions->fNamedFramebufferTexture1D =
+  //     gl->glNamedFramebufferTexture1DEXTFn;
+  // functions->fNamedFramebufferTexture2D =
+  //     gl->glNamedFramebufferTexture2DEXTFn;
+  // functions->fNamedFramebufferTexture3D =
+  //     gl->glNamedFramebufferTexture3DEXTFn;
+  // functions->fNamedFramebufferRenderbuffer =
+  //     gl->glNamedFramebufferRenderbufferEXTFn;
+  // functions->fGetNamedFramebufferAttachmentParameteriv =
+  //     gl->glGetNamedFramebufferAttachmentParameterivEXTFn;
+  // functions->fGenerateTextureMipmap = gl->glGenerateTextureMipmapEXTFn;
+  // functions->fFramebufferDrawBuffer = gl->glFramebufferDrawBufferEXTFn;
+  // functions->fFramebufferDrawBuffers = gl->glFramebufferDrawBuffersEXTFn;
+  // functions->fFramebufferReadBuffer = gl->glFramebufferReadBufferEXTFn;
+  // functions->fGetFramebufferParameteriv =
+  //     gl->glGetFramebufferParameterivEXTFn;
+  // functions->fNamedCopyBufferSubData = gl->glNamedCopyBufferSubDataEXTFn;
+  // functions->fVertexArrayVertexOffset = gl->glVertexArrayVertexOffsetEXTFn;
+  // functions->fVertexArrayColorOffset = gl->glVertexArrayColorOffsetEXTFn;
+  // functions->fVertexArrayEdgeFlagOffset =
+  //     gl->glVertexArrayEdgeFlagOffsetEXTFn;
+  // functions->fVertexArrayIndexOffset = gl->glVertexArrayIndexOffsetEXTFn;
+  // functions->fVertexArrayNormalOffset = gl->glVertexArrayNormalOffsetEXTFn;
+  // functions->fVertexArrayTexCoordOffset =
+  //     gl->glVertexArrayTexCoordOffsetEXTFn;
+  // functions->fVertexArrayMultiTexCoordOffset =
+  //     gl->glVertexArrayMultiTexCoordOffsetEXTFn;
+  // functions->fVertexArrayFogCoordOffset =
+  //     gl->glVertexArrayFogCoordOffsetEXTFn;
+  // functions->fVertexArraySecondaryColorOffset =
+  //     gl->glVertexArraySecondaryColorOffsetEXTFn;
+  // functions->fVertexArrayVertexAttribOffset =
+  //     gl->glVertexArrayVertexAttribOffsetEXTFn;
+  // functions->fVertexArrayVertexAttribIOffset =
+  //     gl->glVertexArrayVertexAttribIOffsetEXTFn;
+  // functions->fEnableVertexArray = gl->glEnableVertexArrayEXTFn;
+  // functions->fDisableVertexArray = gl->glDisableVertexArrayEXTFn;
+  // functions->fEnableVertexArrayAttrib = gl->glEnableVertexArrayAttribEXTFn;
+  // functions->fDisableVertexArrayAttrib = gl->glDisableVertexArrayAttribEXTFn;
+  // functions->fGetVertexArrayIntegerv = gl->glGetVertexArrayIntegervEXTFn;
+  // functions->fGetVertexArrayPointerv = gl->glGetVertexArrayPointervEXTFn;
+  // functions->fGetVertexArrayIntegeri_v = gl->glGetVertexArrayIntegeri_vEXTFn;
+  // functions->fGetVertexArrayPointeri_v = gl->glGetVertexArrayPointeri_vEXTFn;
+  // functions->fMapNamedBufferRange = gl->glMapNamedBufferRangeEXTFn;
+  // functions->fFlushMappedNamedBufferRange =
+  //     gl->glFlushMappedNamedBufferRangeEXTFn;
+  // functions->fTextureBuffer = gl->glTextureBufferEXTFn;
+
+  functions->fDebugMessageControl = gl->glDebugMessageControlFn;
+  functions->fDebugMessageInsert = gl->glDebugMessageInsertFn;
+  // TODO(piman): Our GL headers are out-of-date and define GLDEBUGPROC
+  // incorrectly wrt const-ness.
+  functions->fDebugMessageCallback =
+      reinterpret_cast<GrGLDebugMessageCallbackProc>(
+          gl->glDebugMessageCallbackFn);
+  functions->fGetDebugMessageLog =
+      reinterpret_cast<GrGLGetDebugMessageLogProc>(gl->glGetDebugMessageLogFn);
+  functions->fPushDebugGroup = gl->glPushDebugGroupFn;
+  functions->fPopDebugGroup = gl->glPopDebugGroupFn;
+  functions->fObjectLabel = gl->glObjectLabelFn;
+
+  // GL_EXT_window_rectangles
+  // functions->fWindowRectangles = gl->glWindowRectanglesEXTFn;
+
+  // EGL_KHR_image / EGL_KHR_image_base
+  // functions->fCreateImage = nullptr;
+  // functions->fDestroyImage = nullptr;
+
+  // GL 4.0 or GL_ARB_sample_shading or ES+GL_OES_sample_shading
+  // functions->fMinSampleShading = gl->glMinSampleShadingFn;
+
+  functions->fFenceSync = gl->glFenceSyncFn;
+  functions->fIsSync = gl->glIsSyncFn;
+  functions->fClientWaitSync = gl->glClientWaitSyncFn;
+  functions->fWaitSync = gl->glWaitSyncFn;
+  functions->fDeleteSync = gl->glDeleteSyncFn;
+
+  functions->fBindImageTexture = gl->glBindImageTextureEXTFn;
+  // TODO(piman): skia type is wrong.
+  functions->fMemoryBarrier =
+      reinterpret_cast<GrGLMemoryBarrierProc>(gl->glMemoryBarrierEXTFn);
+
+  // GL 4.5 or GL_ARB_ES3_1_compatibility or ES 3.1
+  // functions->fMemoryBarrierByRegion = gl->glMemoryBarrierByRegionFn;
+
+  functions->fGetInternalformativ = gl->glGetInternalformativFn;
+
+  interface->fStandard = standard;
+  interface->fExtensions.swap(&extensions);
+  sk_sp<const GrGLInterface> returned(interface);
+  return returned;
+}
+
+}  // namespace gles2
+}  // namespace gpu

diff --git a/gpu/command_buffer/service/create_gr_gl_interface.h b/gpu/command_buffer/service/create_gr_gl_interface.h
new file mode 100644
index 0000000..b8feeb4
--- /dev/null
+++ b/gpu/command_buffer/service/create_gr_gl_interface.h

@@ -0,0 +1,25 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef GPU_COMMAND_BUFFER_SERVICE_CREATE_GR_GL_INTERFACE_H_
+#define GPU_COMMAND_BUFFER_SERVICE_CREATE_GR_GL_INTERFACE_H_
+
+#include "third_party/skia/include/gpu/gl/GrGLInterface.h"
+
+namespace gl {
+struct GLVersionInfo;
+}
+
+namespace gpu {
+namespace gles2 {
+
+// Creates a GrGLInterface by taking function pointers from the current
+// GL bindings.
+sk_sp<const GrGLInterface> CreateGrGLInterface(
+    const gl::GLVersionInfo& version_info);
+
+}  // namespace gles2
+}  // namespace gpu
+
+#endif  // GPU_COMMAND_BUFFER_SERVICE_CREATE_GR_GL_INTERFACE_H_

diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index f5f4228..02d5e69 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc

@@ -36,6 +36,7 @@
 #include "gpu/command_buffer/service/command_buffer_service.h"
 #include "gpu/command_buffer/service/context_group.h"
 #include "gpu/command_buffer/service/context_state.h"
+#include "gpu/command_buffer/service/create_gr_gl_interface.h"
 #include "gpu/command_buffer/service/error_state.h"
 #include "gpu/command_buffer/service/feature_info.h"
 #include "gpu/command_buffer/service/framebuffer_manager.h"
@@ -75,8 +76,6 @@
 #include "third_party/skia/include/core/SkTypeface.h"
 #include "third_party/skia/include/gpu/GrBackendSurface.h"
 #include "third_party/skia/include/gpu/GrContext.h"
-#include "third_party/skia/include/gpu/gl/GrGLAssembleInterface.h"
-#include "third_party/skia/include/gpu/gl/GrGLInterface.h"
 #include "third_party/smhasher/src/City.h"
 #include "ui/gfx/buffer_types.h"
 #include "ui/gfx/color_space.h"
@@ -110,11 +109,6 @@
 
 namespace {
 
-static GrGLFuncPtr get_gl_proc(void* ctx, const char name[]) {
-  DCHECK(!ctx);
-  return static_cast<GrGLFuncPtr>(gl::GetGLProcAddress(name));
-}
-
 const char kOESDerivativeExtension[] = "GL_OES_standard_derivatives";
 const char kEXTFragDepthExtension[] = "GL_EXT_frag_depth";
 const char kEXTDrawBuffersExtension[] = "GL_EXT_draw_buffers";
@@ -3719,17 +3713,20 @@
     if (!features().chromium_raster_transport)
       return false;
     sk_sp<const GrGLInterface> interface(
-        GrGLAssembleInterface(nullptr, get_gl_proc));
+        CreateGrGLInterface(gl_version_info()));
     // TODO(enne): if this or gr_context creation below fails in practice for
     // different reasons than the ones the renderer would fail on for gpu
     // raster, expose this in gpu::Capabilities so the renderer can handle it.
     if (!interface)
       return false;
+
     gr_context_ = sk_sp<GrContext>(
         GrContext::Create(kOpenGL_GrBackend,
                           reinterpret_cast<GrBackendContext>(interface.get())));
-    if (!gr_context_)
+    if (!gr_context_) {
+      LOG(ERROR) << "Could not create GrContext";
       return false;
+    }
 
     // TODO(enne): this cache is for this decoder only and each decoder has
     // its own cache.  This is pretty unfortunate.  This really needs to be

diff --git a/gpu/ipc/service/direct_composition_child_surface_win.cc b/gpu/ipc/service/direct_composition_child_surface_win.cc
index 1a7a6a3..bc02f90c 100644
--- a/gpu/ipc/service/direct_composition_child_surface_win.cc
+++ b/gpu/ipc/service/direct_composition_child_surface_win.cc

@@ -113,8 +113,7 @@
     desc.Stereo = FALSE;
     desc.SampleDesc.Count = 1;
     desc.BufferCount = 2;
-    desc.BufferUsage =
-        DXGI_USAGE_RENDER_TARGET_OUTPUT | DXGI_USAGE_SHADER_INPUT;
+    desc.BufferUsage = DXGI_USAGE_RENDER_TARGET_OUTPUT;
     desc.Scaling = DXGI_SCALING_STRETCH;
     desc.SwapEffect = DXGI_SWAP_EFFECT_FLIP_SEQUENTIAL;
     desc.AlphaMode = alpha_mode;

diff --git a/gpu/ipc/service/direct_composition_surface_win_unittest.cc b/gpu/ipc/service/direct_composition_surface_win_unittest.cc
index 1327690..dc7199e 100644
--- a/gpu/ipc/service/direct_composition_surface_win_unittest.cc
+++ b/gpu/ipc/service/direct_composition_surface_win_unittest.cc

@@ -472,32 +472,6 @@
     DestroySurface(std::move(surface_));
   }
 
-  void PixelTestCopyTexture(bool layers_enabled) {
-    if (!CheckIfDCSupported())
-      return;
-    InitializeSurface();
-    surface_->SetEnableDCLayers(layers_enabled);
-    gfx::Size window_size(100, 100);
-
-    scoped_refptr<gl::GLContext> context = gl::init::CreateGLContext(
-        nullptr, surface_.get(), gl::GLContextAttribs());
-    EXPECT_TRUE(surface_->Resize(window_size, 1.0,
-                                 gl::GLSurface::ColorSpace::UNSPECIFIED, true));
-
-    EXPECT_TRUE(surface_->SetDrawRectangle(gfx::Rect(0, 0, 100, 100)));
-    EXPECT_TRUE(context->MakeCurrent(surface_.get()));
-
-    Sleep(1000);
-
-    GLuint texture = 0;
-    glGenTextures(1, &texture);
-    glBindTexture(GL_TEXTURE_2D, texture);
-    glCopyTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 0, 0, 100, 100, 0);
-
-    context = nullptr;
-    DestroySurface(std::move(surface_));
-  }
-
   TestPlatformDelegate platform_delegate_;
   TestImageTransportSurfaceDelegate delegate_;
   ui::WinWindow window_;
@@ -512,14 +486,6 @@
   PixelTestSwapChain(false);
 }
 
-TEST_F(DirectCompositionPixelTest, CopyTextureFromSurfaceWithLayersEnabled) {
-  PixelTestCopyTexture(true);
-}
-
-TEST_F(DirectCompositionPixelTest, CopyTextureFromSurfaceWithLayersDisabled) {
-  PixelTestCopyTexture(false);
-}
-
 bool AreColorsSimilar(int a, int b) {
   // The precise colors may differ depending on the video processor, so allow
   // a margin for error.

diff --git a/ios/chrome/app/chrome_exe_main.mm b/ios/chrome/app/chrome_exe_main.mm
index 308e50d..0a7fa10 100644
--- a/ios/chrome/app/chrome_exe_main.mm
+++ b/ios/chrome/app/chrome_exe_main.mm

@@ -34,7 +34,10 @@
   @autoreleasepool {
     NSUserDefaults* standard_defaults = [NSUserDefaults standardUserDefaults];
     if ([standard_defaults boolForKey:@"EnablePseudoRTL"]) {
-      NSDictionary* pseudoDict = @{@"YES" : @"AppleTextDirection"};
+      NSDictionary* pseudoDict = @{
+        @"AppleTextDirection" : @"YES",
+        @"NSForceRightToLeftWritingDirection" : @"YES"
+      };
       [standard_defaults registerDefaults:pseudoDict];
     }
   }

diff --git a/ios/chrome/app/strings/ios_strings.grd b/ios/chrome/app/strings/ios_strings.grd
index 079c69d..b6f0679 100644
--- a/ios/chrome/app/strings/ios_strings.grd
+++ b/ios/chrome/app/strings/ios_strings.grd

@@ -1576,6 +1576,12 @@
       <message name="IDS_IOS_CHOOSE_EMAIL_CLIENT_APP" desc="Title for action sheet to select an email client app when user taps on an URL that has a mailto: URL scheme. [Length: 50em]">
         Create email with:
       </message>
+      <message name="IDS_IOS_CHOOSE_DEFAULT_EMAIL_CLIENT_APP" desc="Title for action sheet to select an email client app when user taps on an URL that has a mailto: URL scheme. [Length: 50em]">
+        Choose Default Email App
+      </message>
+      <message name="IDS_IOS_CHOOSE_EMAIL_APP_HOW_TO_CHANGE" desc="Subtitle for action sheet to choose mailto:// handler with instructions on how to change the preference in the future. [Length: 80]">
+        You can change this preference anytime in Chrome Settings.
+      </message>
       <message name="IDS_IOS_CHOOSE_EMAIL_ASK_TOGGLE" desc="Title for toggle switch to set whether to ask user which Mail client app to use every time a mailto:// URL is tapped. [Length: 50]">
         Ask me which app to use every time
       </message>

diff --git a/ios/chrome/browser/about_flags.mm b/ios/chrome/browser/about_flags.mm
index b746963c..433c6be3 100644
--- a/ios/chrome/browser/about_flags.mm
+++ b/ios/chrome/browser/about_flags.mm

@@ -174,8 +174,7 @@
          omnibox::kUIExperimentHideSuggestionUrlTrivialSubdomains)},
     {"bookmark-new-generation", flag_descriptions::kBookmarkNewGenerationName,
      flag_descriptions::kBookmarkNewGenerationDescription, flags_ui::kOsIos,
-     FEATURE_VALUE_TYPE(
-         bookmark_new_generation::features::kBookmarkNewGeneration)},
+     FEATURE_VALUE_TYPE(kBookmarkNewGeneration)},
     {"mailto-prompt-for-user-choice",
      flag_descriptions::kMailtoPromptForUserChoiceName,
      flag_descriptions::kMailtoPromptForUserChoiceDescription, flags_ui::kOsIos,

diff --git a/ios/chrome/browser/bookmarks/bookmark_new_generation_features.cc b/ios/chrome/browser/bookmarks/bookmark_new_generation_features.cc
index b1f2a55..250e6d9a 100644
--- a/ios/chrome/browser/bookmarks/bookmark_new_generation_features.cc
+++ b/ios/chrome/browser/bookmarks/bookmark_new_generation_features.cc

@@ -4,11 +4,6 @@
 
 #include "ios/chrome/browser/bookmarks/bookmark_new_generation_features.h"
 
-namespace bookmark_new_generation {
-namespace features {
-
+// Feature flag for the new bookmark UI
 const base::Feature kBookmarkNewGeneration{"BookmarkNewGeneration",
                                            base::FEATURE_DISABLED_BY_DEFAULT};
-
-}  // namespace features
-}  // namespace bookmark_new_generation

diff --git a/ios/chrome/browser/bookmarks/bookmark_new_generation_features.h b/ios/chrome/browser/bookmarks/bookmark_new_generation_features.h
index b8e9323..d6f19b6 100644
--- a/ios/chrome/browser/bookmarks/bookmark_new_generation_features.h
+++ b/ios/chrome/browser/bookmarks/bookmark_new_generation_features.h

@@ -8,13 +8,7 @@
 #include "base/feature_list.h"
 #include "build/build_config.h"
 
-namespace bookmark_new_generation {
-namespace features {
-
-// Used to control the state of the Credential Manager API feature.
+// Feature flag for the new bookmark UI
 extern const base::Feature kBookmarkNewGeneration;
 
-}  // namespace features
-}  // namespace bookmark_new_generation
-
 #endif  // IOS_CHROME_BROWSER_BOOKMARKS_BOOKMARK_NEW_GENERATION_FEATURES_H

diff --git a/ios/chrome/browser/content_suggestions/content_suggestions_coordinator.mm b/ios/chrome/browser/content_suggestions/content_suggestions_coordinator.mm
index ff36172a..e8c7ead6 100644
--- a/ios/chrome/browser/content_suggestions/content_suggestions_coordinator.mm
+++ b/ios/chrome/browser/content_suggestions/content_suggestions_coordinator.mm

@@ -32,10 +32,7 @@
 #include "ios/chrome/browser/reading_list/reading_list_model_factory.h"
 #include "ios/chrome/browser/tabs/tab_constants.h"
 #import "ios/chrome/browser/ui/alert_coordinator/alert_coordinator.h"
-#import "ios/chrome/browser/ui/commands/UIKit+ChromeExecuteCommand.h"
 #import "ios/chrome/browser/ui/commands/browser_commands.h"
-#import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
-#include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #import "ios/chrome/browser/ui/commands/open_new_tab_command.h"
 #import "ios/chrome/browser/ui/commands/reading_list_add_command.h"
 #import "ios/chrome/browser/ui/content_suggestions/cells/content_suggestions_gesture_commands.h"
@@ -73,7 +70,15 @@
 #endif
 
 namespace {
+
 const char kNTPHelpURL[] = "https://support.google.com/chrome/?p=ios_new_tab";
+
+// The What's New promo command that shows the Bookmarks Manager.
+const char kBookmarkCommand[] = "bookmark";
+
+// The What's New promo command that launches Rate This App.
+const char kRateThisAppCommand[] = "ratethisapp";
+
 }  // namespace
 
 @interface ContentSuggestionsCoordinator ()<
@@ -342,18 +347,18 @@
     return;
   }
 
-  if (notificationPromo->IsChromeCommand()) {
-    int command_id = notificationPromo->command_id();
-    if (command_id == IDC_RATE_THIS_APP) {
-      [self.dispatcher performSelector:@selector(showRateThisAppDialog)];
+  if (notificationPromo->IsChromeCommandPromo()) {
+    std::string command = notificationPromo->command();
+    if (command == kBookmarkCommand) {
+      [self.dispatcher showBookmarksManager];
+    } else if (command == kRateThisAppCommand) {
+      [self.dispatcher showRateThisAppDialog];
     } else {
-      GenericChromeCommand* command = [[GenericChromeCommand alloc]
-          initWithTag:notificationPromo->command_id()];
-      [self.suggestionsViewController chromeExecuteCommand:command];
+      NOTREACHED() << "Promo command is not valid.";
     }
     return;
   }
-  NOTREACHED();
+  NOTREACHED() << "Promo type is neither URL or command.";
 }
 
 - (void)handleLearnMoreTapped {

diff --git a/ios/chrome/browser/prefs/browser_prefs.mm b/ios/chrome/browser/prefs/browser_prefs.mm
index cbd3841..1fe3434e4 100644
--- a/ios/chrome/browser/prefs/browser_prefs.mm
+++ b/ios/chrome/browser/prefs/browser_prefs.mm

@@ -126,8 +126,7 @@
   DesktopPromotionSyncService::RegisterDesktopPromotionUserPrefs(registry);
   RegisterVoiceSearchBrowserStatePrefs(registry);
 
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     [BookmarkTableView registerBrowserStatePrefs:registry];
   } else {
     [BookmarkCollectionView registerBrowserStatePrefs:registry];

diff --git a/ios/chrome/browser/tabs/tab_unittest.mm b/ios/chrome/browser/tabs/tab_unittest.mm
index 76880a9..8bad150 100644
--- a/ios/chrome/browser/tabs/tab_unittest.mm
+++ b/ios/chrome/browser/tabs/tab_unittest.mm

@@ -217,7 +217,7 @@
     std::unique_ptr<web::NavigationContext> context1 =
         web::NavigationContextImpl::CreateNavigationContext(
             web_state_impl_.get(), userUrl,
-            ui::PageTransition::PAGE_TRANSITION_TYPED);
+            ui::PageTransition::PAGE_TRANSITION_TYPED, false);
     web_state_impl_->OnNavigationStarted(context1.get());
     [tab_ webWillAddPendingURL:redirectUrl
                     transition:ui::PAGE_TRANSITION_CLIENT_REDIRECT];
@@ -231,7 +231,7 @@
     std::unique_ptr<web::NavigationContext> context2 =
         web::NavigationContextImpl::CreateNavigationContext(
             web_state_impl_.get(), redirectUrl,
-            ui::PageTransition::PAGE_TRANSITION_TYPED);
+            ui::PageTransition::PAGE_TRANSITION_TYPED, false);
     web_state_impl_->OnNavigationStarted(context2.get());
     [tab_ navigationManagerImpl]->CommitPendingItem();
     web_state_impl_->UpdateHttpResponseHeaders(redirectUrl);

diff --git a/ios/chrome/browser/ui/authentication/signin_interaction_controller_egtest.mm b/ios/chrome/browser/ui/authentication/signin_interaction_controller_egtest.mm
index fcaea5b..bd991ab 100644
--- a/ios/chrome/browser/ui/authentication/signin_interaction_controller_egtest.mm
+++ b/ios/chrome/browser/ui/authentication/signin_interaction_controller_egtest.mm

@@ -503,8 +503,7 @@
 // Bookmarks UI.
 - (void)testSignInCancelFromBookmarks {
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
 
   ChromeIdentity* identity = GetFakeIdentity1();
   ios::FakeChromeIdentityService::GetInstanceFromChromeProvider()->AddIdentity(

diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_collection_view.mm b/ios/chrome/browser/ui/bookmarks/bookmark_collection_view.mm
index d84dc64..1604228 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_collection_view.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_collection_view.mm

@@ -1317,9 +1317,10 @@
   return NO;
 }
 
-#pragma mark - Exposed to the SyncedSessionsObserver
+#pragma mark - SyncedSessionsObserver
 
 - (void)reloadSessions {
+  // Nothing to do.
 }
 
 - (void)onSyncStateChanged {

diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_home_handset_view_controller.mm b/ios/chrome/browser/ui/bookmarks/bookmark_home_handset_view_controller.mm
index b5529ddb..57d005f 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_home_handset_view_controller.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_home_handset_view_controller.mm

@@ -95,8 +95,7 @@
 - (void)viewDidLoad {
   [super viewDidLoad];
 
-  if (!base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (!base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     self.navigationBar.frame = [self navigationBarFrame];
     [self.navigationBar setMenuTarget:self
                                action:@selector(navigationBarToggledMenu:)];
@@ -133,8 +132,7 @@
 
 - (void)viewWillLayoutSubviews {
   [super viewWillLayoutSubviews];
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     // TODO(crbug.com/695749): See if we need to store/restore the content
     // scroll position for BookmarkTableView here.
     return;
@@ -185,8 +183,7 @@
   // TODO(crbug.com/695749): Restore the content scroll position for
   // BookmarkTableView in the UI.
 
-  if (!base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (!base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     self.menuView.delegate = self;
 
     // Set view frames and add them to hierarchy.

diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm b/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm
index 0dee672..69baefa 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller.mm

@@ -128,8 +128,7 @@
 
 - (void)viewDidLoad {
   [super viewDidLoad];
-  if (!base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (!base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     self.navigationBar =
         [[BookmarkNavigationBar alloc] initWithFrame:CGRectZero];
     [self.navigationBar setEditTarget:self
@@ -143,8 +142,7 @@
 
 - (void)viewWillLayoutSubviews {
   [super viewWillLayoutSubviews];
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     // Resize the custom title view (placed as leftBarButtonItem) on the
     // navigation bar according to the space available, so that we truncate it
     // correctly.
@@ -172,8 +170,7 @@
 #pragma mark - Protected
 
 - (void)loadBookmarkViews {
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     [self loadBookmarkViewsForNewUI];
   } else {
     [self loadBookmarkViewsForOldUI];
@@ -262,8 +259,7 @@
 #pragma mark - BookmarkPromoControllerDelegate
 
 - (void)promoStateChanged:(BOOL)promoEnabled {
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     [self.bookmarksTableView promoStateChangedAnimated:YES];
   } else {
     [self.folderView promoStateChangedAnimated:YES];
@@ -1001,8 +997,7 @@
 }
 
 - (void)updateViewConstraints {
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     if (self.contextBar) {
       NSDictionary* views = @{
         @"tableView" : self.bookmarksTableView,

diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller_protected.h b/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller_protected.h
index 69108a7d..bb39511 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller_protected.h
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_home_view_controller_protected.h

@@ -40,8 +40,8 @@
 // The main view showing all the bookmarks.
 @property(nonatomic, strong) BookmarkCollectionView* folderView;
 
-// The main view showing all the bookmarks. (Used only when
-// features::kBookmarkNewGeneration is enabled)
+// The main view showing all the bookmarks. (Used only when the flag
+// kBookmarkNewGeneration is enabled)
 @property(nonatomic, strong) BookmarkTableView* bookmarksTableView;
 
 // The view controller used to pick a folder in which to move the selected
@@ -57,8 +57,8 @@
 // The navigation bar sits on top of the main content.
 @property(nonatomic, strong) BookmarkNavigationBar* navigationBar;
 
-// The context bar at the bottom of the bookmarks. (Used only when
-// features::kBookmarkNewGeneration is enabled)
+// The context bar at the bottom of the bookmarks. (Used only when the flag
+// kBookmarkNewGeneration is enabled)
 @property(nonatomic, strong) BookmarkContextBar* contextBar;
 
 // At any point in time, there is exactly one collection view whose view is part

diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_interaction_controller.mm b/ios/chrome/browser/ui/bookmarks/bookmark_interaction_controller.mm
index 7730d70..420757c 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_interaction_controller.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_interaction_controller.mm

@@ -169,8 +169,7 @@
                                   loader:_loader];
   self.bookmarkBrowser.homeDelegate = self;
 
-  if (base::FeatureList::IsEnabled(
-          bookmark_new_generation::features::kBookmarkNewGeneration)) {
+  if (base::FeatureList::IsEnabled(kBookmarkNewGeneration)) {
     [self.bookmarkBrowser setRootNode:self.bookmarkModel->root_node()];
     UINavigationController* navController = [[UINavigationController alloc]
         initWithRootViewController:self.bookmarkBrowser];

diff --git a/ios/chrome/browser/ui/bookmarks/bookmark_table_view.mm b/ios/chrome/browser/ui/bookmarks/bookmark_table_view.mm
index 4f48183..6d5f8563 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmark_table_view.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmark_table_view.mm

@@ -134,10 +134,11 @@
         ios::BookmarkModelFactory::GetForBrowserState(browserState);
 
     // Set up observers.
-    _modelBridge.reset(
-        new bookmarks::BookmarkModelBridge(self, _bookmarkModel));
-    _syncedSessionsObserver.reset(
-        new synced_sessions::SyncedSessionsObserverBridge(self, _browserState));
+    _modelBridge =
+        std::make_unique<bookmarks::BookmarkModelBridge>(self, _bookmarkModel);
+    _syncedSessionsObserver =
+        std::make_unique<synced_sessions::SyncedSessionsObserverBridge>(
+            self, _browserState);
 
     [self computeBookmarkTableViewData];
 
@@ -536,7 +537,7 @@
         _syncedSessionsObserver->IsSyncing()) {
       [self showLoadingSpinnerBackground];
     } else {
-      [self hideLoadingSpinner];
+      [self hideLoadingSpinnerBackground];
     }
     return;
   }
@@ -561,7 +562,7 @@
 }
 
 // Hide the loading spinner if it is showing.
-- (void)hideLoadingSpinner {
+- (void)hideLoadingSpinnerBackground {
   if (self.spinnerView) {
     [self.spinnerView stopWaitingWithCompletion:^{
       [UIView animateWithDuration:0.2
@@ -692,9 +693,10 @@
   _faviconLoadTasks[IntegerPair(indexPath.section, indexPath.item)] = taskId;
 }
 
-#pragma mark - Exposed to the SyncedSessionsObserver
+#pragma mark - SyncedSessionsObserver
 
 - (void)reloadSessions {
+  // Nothing to do.
 }
 
 - (void)onSyncStateChanged {

diff --git a/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm b/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm
index 454ee29..7796161 100644
--- a/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm
+++ b/ios/chrome/browser/ui/bookmarks/bookmarks_new_generation_egtest.mm

@@ -93,8 +93,7 @@
   }
 
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase setupStandardBookmarks];
   [BookmarksNewGenTestCase openBookmarks];
@@ -126,8 +125,7 @@
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase setupStandardBookmarks];
   [BookmarksNewGenTestCase openBookmarks];
@@ -153,8 +151,7 @@
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase setupStandardBookmarks];
   [BookmarksNewGenTestCase openBookmarks];
@@ -193,8 +190,7 @@
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase setupStandardBookmarks];
   [BookmarksNewGenTestCase openBookmarks];
@@ -229,8 +225,7 @@
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase openBookmarks];
 
@@ -261,8 +256,7 @@
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase setupStandardBookmarks];
   [BookmarksNewGenTestCase openBookmarks];
@@ -312,8 +306,7 @@
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   [BookmarksNewGenTestCase setupStandardBookmarks];
   [BookmarksNewGenTestCase openBookmarks];
@@ -352,10 +345,12 @@
 - (void)testAutomaticSigninPromoDismiss {
   if (IsIPadIdiom()) {
     EARL_GREY_TEST_DISABLED(@"Test disabled on iPad.");
+  } else {
+    // TODO(crbug.com/761349): Fix test.
+    EARL_GREY_TEST_DISABLED(@"Test temporarily disabled on iPhone.");
   }
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndEnableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndEnableFeature(kBookmarkNewGeneration);
 
   ios::ChromeBrowserState* browser_state =
       chrome_test_util::GetOriginalBrowserState();

diff --git a/ios/chrome/browser/ui/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view_controller.mm
index cc62225..0974a37 100644
--- a/ios/chrome/browser/ui/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view_controller.mm

@@ -4415,6 +4415,15 @@
                   appendTo:kCurrentTab];
 }
 
+- (void)showBookmarksManager {
+  if (IsIPadIdiom()) {
+    [self showAllBookmarks];
+  } else {
+    [self initializeBookmarkInteractionController];
+    [_bookmarkInteractionController presentBookmarks];
+  }
+}
+
 #pragma mark - Command Handling
 
 - (IBAction)chromeExecuteCommand:(id)sender {
@@ -4433,15 +4442,6 @@
     case IDC_REQUEST_MOBILE_SITE:
       [[_model currentTab] reloadWithUserAgentType:web::UserAgentType::MOBILE];
       break;
-    case IDC_SHOW_BOOKMARK_MANAGER: {
-      if (IsIPadIdiom()) {
-        [self showAllBookmarks];
-      } else {
-        [self initializeBookmarkInteractionController];
-        [_bookmarkInteractionController presentBookmarks];
-      }
-      break;
-    }
     case IDC_SHOW_OTHER_DEVICES: {
       if (IsIPadIdiom()) {
         [self showNTPPanel:ntp_home::RECENT_TABS_PANEL];

diff --git a/ios/chrome/browser/ui/commands/browser_commands.h b/ios/chrome/browser/ui/commands/browser_commands.h
index 69ffafc..c857d57 100644
--- a/ios/chrome/browser/ui/commands/browser_commands.h
+++ b/ios/chrome/browser/ui/commands/browser_commands.h

@@ -101,6 +101,9 @@
 // Shows the online help page in a tab.
 - (void)showHelpPage;
 
+// Shows the bookmarks manager.
+- (void)showBookmarksManager;
+
 @end
 
 #endif  // IOS_CHROME_BROWSER_UI_COMMANDS_BROWSER_COMMANDS_H_

diff --git a/ios/chrome/browser/ui/commands/ios_command_ids.h b/ios/chrome/browser/ui/commands/ios_command_ids.h
index cdd34d7..221dd16 100644
--- a/ios/chrome/browser/ui/commands/ios_command_ids.h
+++ b/ios/chrome/browser/ui/commands/ios_command_ids.h

@@ -13,7 +13,6 @@
 // also need to be updated.
 
 // clang-format off
-#define IDC_SHOW_BOOKMARK_MANAGER                      40011
 #define IDC_SHOW_SIGNIN_IOS                            40905
 #define IDC_SHOW_ADD_ACCOUNT                           40910
 #define IDC_SHOW_SYNC_SETTINGS                         40914
@@ -22,7 +21,6 @@
 #define IDC_REQUEST_MOBILE_SITE                        40922
 #define IDC_CLEAR_BROWSING_DATA_IOS                    40924
 #define IDC_SHOW_MAIL_COMPOSER                         40926
-#define IDC_RATE_THIS_APP                              40948
 #define IDC_SHOW_SYNC_PASSPHRASE_SETTINGS              40952
 // clang-format on
 

diff --git a/ios/chrome/browser/ui/dialogs/java_script_dialog_presenter_impl.h b/ios/chrome/browser/ui/dialogs/java_script_dialog_presenter_impl.h
index eec3ef2b..34cd7c9 100644
--- a/ios/chrome/browser/ui/dialogs/java_script_dialog_presenter_impl.h
+++ b/ios/chrome/browser/ui/dialogs/java_script_dialog_presenter_impl.h

@@ -12,7 +12,8 @@
 @class AlertCoordinator;
 @class DialogPresenter;
 
-class JavaScriptDialogPresenterImpl : public web::JavaScriptDialogPresenter {
+class JavaScriptDialogPresenterImpl final
+    : public web::JavaScriptDialogPresenter {
  public:
   explicit JavaScriptDialogPresenterImpl(DialogPresenter* dialogPresenter);
   ~JavaScriptDialogPresenterImpl();

diff --git a/ios/chrome/browser/ui/keyboard_commands_egtest.mm b/ios/chrome/browser/ui/keyboard_commands_egtest.mm
index 6ac0e806..78fe598 100644
--- a/ios/chrome/browser/ui/keyboard_commands_egtest.mm
+++ b/ios/chrome/browser/ui/keyboard_commands_egtest.mm

@@ -181,8 +181,7 @@
 // Bookmarks UI.
 - (void)testKeyboardCommandsNotRegistered_BookmarksPresented {
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
 
   // Open Bookmarks
   [self selectToolsMenuItem:grey_accessibilityID(kToolsMenuBookmarksId)];

diff --git a/ios/chrome/browser/ui/ntp/google_landing_mediator.mm b/ios/chrome/browser/ui/ntp/google_landing_mediator.mm
index 50636b9..020073b 100644
--- a/ios/chrome/browser/ui/ntp/google_landing_mediator.mm
+++ b/ios/chrome/browser/ui/ntp/google_landing_mediator.mm

@@ -28,11 +28,8 @@
 #include "ios/chrome/browser/reading_list/reading_list_model_factory.h"
 #include "ios/chrome/browser/search_engines/template_url_service_factory.h"
 #import "ios/chrome/browser/ui/browser_view_controller.h"
-#import "ios/chrome/browser/ui/commands/UIKit+ChromeExecuteCommand.h"
 #include "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/commands/command_dispatcher.h"
-#import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
-#include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #import "ios/chrome/browser/ui/ntp/google_landing_consumer.h"
 #import "ios/chrome/browser/ui/ntp/notification_promo_whats_new.h"
 #include "ios/chrome/browser/ui/ntp/ntp_tile_saver.h"
@@ -54,6 +51,12 @@
 
 namespace {
 
+// The What's New promo command that shows the Bookmarks Manager.
+const char kBookmarkCommand[] = "bookmark";
+
+// The What's New promo command that launches Rate This App.
+const char kRateThisAppCommand[] = "ratethisapp";
+
 const CGFloat kFaviconMinSize = 32;
 const NSInteger kMaxNumMostVisitedFavicons = 8;
 
@@ -150,7 +153,8 @@
 @property(nonatomic, assign, readonly) WebStateList* webStateList;
 
 // The dispatcher for this mediator.
-@property(nonatomic, weak) id<ChromeExecuteCommand, UrlLoader> dispatcher;
+@property(nonatomic, weak) id<BrowserCommands, ChromeExecuteCommand, UrlLoader>
+    dispatcher;
 
 // Perform initial setup.
 - (void)setUp;
@@ -165,7 +169,9 @@
 
 - (instancetype)initWithConsumer:(id<GoogleLandingConsumer>)consumer
                     browserState:(ios::ChromeBrowserState*)browserState
-                      dispatcher:(id<ChromeExecuteCommand, UrlLoader>)dispatcher
+                      dispatcher:
+                          (id<BrowserCommands, ChromeExecuteCommand, UrlLoader>)
+                              dispatcher
                     webStateList:(WebStateList*)webStateList {
   self = [super init];
   if (self) {
@@ -449,18 +455,18 @@
     return;
   }
 
-  if (_notificationPromo->IsChromeCommand()) {
-    int command_id = _notificationPromo->command_id();
-    if (command_id == IDC_RATE_THIS_APP) {
-      [self.dispatcher performSelector:@selector(showRateThisAppDialog)];
+  if (_notificationPromo->IsChromeCommandPromo()) {
+    std::string command = _notificationPromo->command();
+    if (command == kBookmarkCommand) {
+      [self.dispatcher showBookmarksManager];
+    } else if (command == kRateThisAppCommand) {
+      [self.dispatcher showRateThisAppDialog];
     } else {
-      GenericChromeCommand* command =
-          [[GenericChromeCommand alloc] initWithTag:command_id];
-      [self.dispatcher chromeExecuteCommand:command];
+      NOTREACHED() << "Promo command is not valid.";
     }
     return;
   }
-  NOTREACHED();
+  NOTREACHED() << "Promo type is neither URL or command.";
 }
 
 #pragma mark - Private

diff --git a/ios/chrome/browser/ui/ntp/new_tab_page_controller.mm b/ios/chrome/browser/ui/ntp/new_tab_page_controller.mm
index a62d7c7..b11b6fd 100644
--- a/ios/chrome/browser/ui/ntp/new_tab_page_controller.mm
+++ b/ios/chrome/browser/ui/ntp/new_tab_page_controller.mm

@@ -26,6 +26,7 @@
 #import "ios/chrome/browser/ui/bookmarks/bookmark_controller_factory.h"
 #import "ios/chrome/browser/ui/bookmarks/bookmark_home_tablet_ntp_controller.h"
 #import "ios/chrome/browser/ui/commands/UIKit+ChromeExecuteCommand.h"
+#import "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
 #include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #import "ios/chrome/browser/ui/content_suggestions/ntp_home_constant.h"
@@ -179,6 +180,7 @@
 // is initiated, and when WebController calls -willBeDismissed.
 @property(nonatomic, weak) UIViewController* parentViewController;
 
+// TODO(crbug.com/761031) : Make dispatcher conform to necessary protocols.
 // To ease modernizing the NTP a non-descript CommandDispatcher is passed
 // through to be used by the reuabled NTP panels.
 @property(nonatomic, weak) id dispatcher;
@@ -671,9 +673,9 @@
     [self.ntpView.scrollView setContentOffset:point animated:animate];
   } else {
     if (item.identifier == ntp_home::BOOKMARKS_PANEL) {
-      GenericChromeCommand* command =
-          [[GenericChromeCommand alloc] initWithTag:IDC_SHOW_BOOKMARK_MANAGER];
-      [self.ntpView chromeExecuteCommand:command];
+      // TODO(crbug.com/761031) : Directly call method after dispatcher conforms
+      // to protocol.
+      [self.dispatcher performSelector:@selector(showBookmarksManager)];
     } else if (item.identifier == ntp_home::RECENT_TABS_PANEL) {
       GenericChromeCommand* command =
           [[GenericChromeCommand alloc] initWithTag:IDC_SHOW_OTHER_DEVICES];

diff --git a/ios/chrome/browser/ui/ntp/new_tab_page_egtest.mm b/ios/chrome/browser/ui/ntp/new_tab_page_egtest.mm
index c0f372de5..82428a6 100644
--- a/ios/chrome/browser/ui/ntp/new_tab_page_egtest.mm
+++ b/ios/chrome/browser/ui/ntp/new_tab_page_egtest.mm

@@ -9,6 +9,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "components/strings/grit/components_strings.h"
 #include "ios/chrome/browser/bookmarks/bookmark_new_generation_features.h"
+#import "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
 #include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #import "ios/chrome/browser/ui/content_suggestions/ntp_home_constant.h"
@@ -66,18 +67,13 @@
       chrome_test_util::GetCurrentNewTabPageController();
   if (IsIPadIdiom()) {
     [ntp_controller selectPanel:panel_type];
-  } else {
-    NSUInteger tag = 0;
-    if (panel_type == ntp_home::BOOKMARKS_PANEL) {
-      tag = IDC_SHOW_BOOKMARK_MANAGER;
-    } else if (panel_type == ntp_home::RECENT_TABS_PANEL) {
-      tag = IDC_SHOW_OTHER_DEVICES;
-    }
-    if (tag) {
-      GenericChromeCommand* command =
-          [[GenericChromeCommand alloc] initWithTag:tag];
-      chrome_test_util::RunCommandWithActiveViewController(command);
-    }
+  } else if (panel_type == ntp_home::BOOKMARKS_PANEL) {
+    [chrome_test_util::BrowserCommandDispatcherForMainBVC()
+        showBookmarksManager];
+  } else if (panel_type == ntp_home::RECENT_TABS_PANEL) {
+    GenericChromeCommand* command =
+        [[GenericChromeCommand alloc] initWithTag:IDC_SHOW_OTHER_DEVICES];
+    chrome_test_util::RunCommandWithActiveViewController(command);
   }
   [[GREYUIThreadExecutor sharedInstance] drainUntilIdle];
 }
@@ -127,8 +123,7 @@
 // Bookmarks UI.
 - (void)testAccessibilityOnBookmarks {
   base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(
-      bookmark_new_generation::features::kBookmarkNewGeneration);
+  scoped_feature_list.InitAndDisableFeature(kBookmarkNewGeneration);
 
   SelectNewTabPagePanel(ntp_home::BOOKMARKS_PANEL);
   chrome_test_util::VerifyAccessibilityForCurrentScreen();

diff --git a/ios/chrome/browser/ui/ntp/notification_promo_whats_new.h b/ios/chrome/browser/ui/ntp/notification_promo_whats_new.h
index b1b0f48..a8aed28c 100644
--- a/ios/chrome/browser/ui/ntp/notification_promo_whats_new.h
+++ b/ios/chrome/browser/ui/ntp/notification_promo_whats_new.h

@@ -45,8 +45,8 @@
   WhatsNewIcon icon() { return icon_; }
   bool IsURLPromo() const;
   const GURL& url() { return url_; }
-  bool IsChromeCommand() const;
-  int command_id() { return command_id_; }
+  bool IsChromeCommandPromo() const;
+  const std::string& command() { return command_; }
 
  private:
   // Initialize the state and validity from the low-level notification_promo_.
@@ -92,7 +92,7 @@
   GURL url_;
 
   // If promo type is 'chrome_command'.
-  int command_id_;
+  std::string command_;
 
   // Metric name to append
   std::string metric_name_;

diff --git a/ios/chrome/browser/ui/ntp/notification_promo_whats_new.mm b/ios/chrome/browser/ui/ntp/notification_promo_whats_new.mm
index 48f8a789..4444a00 100644
--- a/ios/chrome/browser/ui/ntp/notification_promo_whats_new.mm
+++ b/ios/chrome/browser/ui/ntp/notification_promo_whats_new.mm

@@ -21,7 +21,6 @@
 #include "ios/chrome/browser/experimental_flags.h"
 #include "ios/chrome/browser/notification_promo.h"
 #include "ios/chrome/browser/pref_names.h"
-#include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #include "ios/chrome/grit/ios_chromium_strings.h"
 #include "ios/chrome/grit/ios_strings.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -160,7 +159,7 @@
   return promo_type_ == "url";
 }
 
-bool NotificationPromoWhatsNew::IsChromeCommand() const {
+bool NotificationPromoWhatsNew::IsChromeCommandPromo() const {
   return promo_type_ == "chrome_command";
 }
 
@@ -193,14 +192,9 @@
     if (url_.is_empty() || !url_.is_valid()) {
       return valid_;
     }
-  } else if (IsChromeCommand()) {
-    std::string command;
-    notification_promo_.promo_payload()->GetString("command", &command);
-    if (command == "bookmark") {
-      command_id_ = IDC_SHOW_BOOKMARK_MANAGER;
-    } else if (command == "ratethisapp") {
-      command_id_ = IDC_RATE_THIS_APP;
-    } else {
+  } else if (IsChromeCommandPromo()) {
+    notification_promo_.promo_payload()->GetString("command", &command_);
+    if ((command_ != "bookmark") && (command_ != "ratethisapp")) {
       return valid_;
     }
   } else {  // If |promo_type_| is not set to URL or Command, return early.

diff --git a/ios/chrome/browser/ui/ntp/notification_promo_whats_new_unittest.mm b/ios/chrome/browser/ui/ntp/notification_promo_whats_new_unittest.mm
index 47a4a2f..cc1ecf6 100644
--- a/ios/chrome/browser/ui/ntp/notification_promo_whats_new_unittest.mm
+++ b/ios/chrome/browser/ui/ntp/notification_promo_whats_new_unittest.mm

@@ -15,7 +15,6 @@
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/testing_pref_service.h"
 #include "components/variations/variations_associated_data.h"
-#include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #include "ios/chrome/grit/ios_chromium_strings.h"
 #include "ios/public/provider/chrome/browser/images/whats_new_icon.h"
 #include "testing/platform_test.h"
@@ -92,7 +91,7 @@
   void RunTests(const std::string& promo_text,
                 const std::string& promo_type,
                 const std::string& url,
-                int command_id,
+                const std::string& command,
                 WhatsNewIcon icon,
                 bool valid) {
     EXPECT_EQ(promo_text, promo_.promo_text());
@@ -100,7 +99,7 @@
     if (promo_type == "url")
       EXPECT_EQ(url, promo_.url().spec());
     else
-      EXPECT_EQ(command_id, promo_.command_id());
+      EXPECT_EQ(command, promo_.command());
 
     EXPECT_EQ(valid, promo_.CanShow());
     // |icon()| is set only if the promo is valid.
@@ -132,7 +131,7 @@
        "0", "chrome_command", "", "ratethisapp", "RateThisAppPromo", "logo",
        "0", "0");
   RunTests(l10n_util::GetStringUTF8(IDS_IOS_APP_RATING_PROMO_STRING),
-           "chrome_command", "", IDC_RATE_THIS_APP, WHATS_NEW_LOGO, true);
+           "chrome_command", "", "ratethisapp", WHATS_NEW_LOGO, true);
 }
 
 // Test that a url-based, valid promo is shown with the correct text and icon.
@@ -140,7 +139,7 @@
   Init("3 Aug 1999 9:26:06 GMT", "3 Aug 2199 9:26:06 GMT", "moveToDockTip", "0",
        "url", "http://blog.chromium.org", "", "TestURLPromo", "", "0", "0");
   RunTests(l10n_util::GetStringUTF8(IDS_IOS_MOVE_TO_DOCK_TIP), "url",
-           "http://blog.chromium.org/", 0, WHATS_NEW_INFO, true);
+           "http://blog.chromium.org/", "", WHATS_NEW_INFO, true);
 }
 
 // Test that a promo without a valid promo type is not shown.

diff --git a/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm b/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm
index 8a4ab49..cf01189 100644
--- a/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm

@@ -28,25 +28,31 @@
   autofill::AutofillProfile _profile1;
   autofill::AutofillProfile _profile2;
   autofill::CreditCard _creditCard1;
+  autofill::CreditCard _creditCard2;
 }
 
-#pragma mark - XCTestCase
+#pragma mark - Helper methods
 
-// Set up called once before each test.
-- (void)setUp {
-  [super setUp];
-
+- (void)addProfiles {
   _profile1 = autofill::test::GetFullProfile();
   [self addAutofillProfile:_profile1];
 
   _profile2 = autofill::test::GetFullProfile2();
   [self addAutofillProfile:_profile2];
+}
 
+- (void)addCard1 {
   _creditCard1 = autofill::test::GetCreditCard();
   _creditCard1.set_billing_address_id(_profile1.guid());
   [self addCreditCard:_creditCard1];
 }
 
+- (void)addCard2 {
+  _creditCard2 = autofill::test::GetCreditCard2();
+  _creditCard2.set_billing_address_id(_profile2.guid());
+  [self addCreditCard:_creditCard2];
+}
+
 #pragma mark - Tests
 
 // Tests that the selected instrument metric is correctly logged when the
@@ -54,6 +60,9 @@
 - (void)testSelectedPaymentMethod {
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_no_shipping_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [self payWithCreditCardUsingCVC:@"123"];
@@ -107,6 +116,9 @@
 
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_bobpay_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [self waitForWebViewContainingTexts:{"rejected"}];
@@ -162,6 +174,9 @@
 - (void)testShowSameRequest {
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_multiple_show_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [ChromeEarlGrey tapWebViewElementWithID:@"showAgain"];
@@ -224,6 +239,9 @@
 - (void)testAllSectionStats_NumberOfSuggestionsShown_Completed {
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:
             "payment_request_contact_details_and_free_shipping_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
@@ -286,14 +304,24 @@
 // Tests that the correct number of suggestions shown for each section is logged
 // when a Payment Request is aborted by the user.
 - (void)testAllSectionStats_NumberOfSuggestionsShown_UserAborted {
+  if (!base::ios::IsRunningOnOrLater(10, 3, 0)) {
+    EARL_GREY_TEST_SKIPPED(
+        @"Disabled on iOS versions below 10.3 because DOMException is not "
+        @"available.");
+  }
+
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:
             "payment_request_contact_details_and_free_shipping_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [[EarlGrey
       selectElementWithMatcher:chrome_test_util::ButtonWithAccessibilityLabelId(
                                    IDS_CANCEL)] performAction:grey_tap()];
+  [self waitForWebViewContainingTexts:{"Request cancelled"}];
 
   FailureBlock failureBlock = ^(NSString* error) {
     GREYFail(error);
@@ -354,6 +382,9 @@
 - (void)testNoShippingSectionStats_NumberOfSuggestionsShown_Completed {
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_contact_details_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [self payWithCreditCardUsingCVC:@"123"];
@@ -417,13 +448,23 @@
 // Tests that the correct number of suggestions shown for each section is logged
 // when a Payment Request is aborted by the user.
 - (void)testNoShippingSectionStats_NumberOfSuggestionsShown_UserAborted {
+  if (!base::ios::IsRunningOnOrLater(10, 3, 0)) {
+    EARL_GREY_TEST_SKIPPED(
+        @"Disabled on iOS versions below 10.3 because DOMException is not "
+        @"available.");
+  }
+
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_contact_details_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [[EarlGrey
       selectElementWithMatcher:chrome_test_util::ButtonWithAccessibilityLabelId(
                                    IDS_CANCEL)] performAction:grey_tap()];
+  [self waitForWebViewContainingTexts:{"Request cancelled"}];
 
   FailureBlock failureBlock = ^(NSString* error) {
     GREYFail(error);
@@ -486,6 +527,9 @@
 - (void)testNoContactDetailSectionStats_NumberOfSuggestionsShown_Completed {
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_free_shipping_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [self payWithCreditCardUsingCVC:@"123"];
@@ -550,13 +594,23 @@
 // Tests that the correct number of suggestions shown for each section is logged
 // when a Payment Request is aborted by the user.
 - (void)testNoContactDetailSectionStats_NumberOfSuggestionsShown_UserAborted {
+  if (!base::ios::IsRunningOnOrLater(10, 3, 0)) {
+    EARL_GREY_TEST_SKIPPED(
+        @"Disabled on iOS versions below 10.3 because DOMException is not "
+        @"available.");
+  }
+
   chrome_test_util::HistogramTester histogramTester;
 
+  [self addProfiles];
+  [self addCard1];
+
   [self loadTestPage:"payment_request_free_shipping_test.html"];
   [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
   [[EarlGrey
       selectElementWithMatcher:chrome_test_util::ButtonWithAccessibilityLabelId(
                                    IDS_CANCEL)] performAction:grey_tap()];
+  [self waitForWebViewContainingTexts:{"Request cancelled"}];
 
   FailureBlock failureBlock = ^(NSString* error) {
     GREYFail(error);
@@ -619,4 +673,204 @@
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_OTHER, @"");
 }
 
+// Tests that the correct number of suggestions shown for each section is logged
+// when a Payment Request is aborted by the user.
+- (void)testNotShown_OnlyNotShownMetricsLogged {
+  chrome_test_util::HistogramTester histogramTester;
+
+  [self loadTestPage:"payment_request_can_make_payment_metrics_test.html"];
+  [ChromeEarlGrey tapWebViewElementWithID:@"queryNoShow"];
+
+  // Navigate away to abort the Payment Request and trigger the logs.
+  [self loadTestPage:"payment_request_email_test.html"];
+
+  FailureBlock failureBlock = ^(NSString* error) {
+    GREYFail(error);
+  };
+
+  // Abort should not be logged.
+  histogramTester.ExpectTotalCount("PaymentRequest.CheckoutFunnel.Aborted", 0,
+                                   failureBlock);
+
+  // Some events should be logged.
+  std::vector<chrome_test_util::Bucket> buckets =
+      histogramTester.GetAllSamples("PaymentRequest.Events");
+  GREYAssertEqual(1U, buckets.size(), @"Exactly one bucket");
+
+  // Only USER_ABORTED and CAN_MAKE_PAYMENT_FALSE should be logged.
+  GREYAssertEqual(JourneyLogger::EVENT_USER_ABORTED |
+                      JourneyLogger::EVENT_CAN_MAKE_PAYMENT_FALSE |
+                      JourneyLogger::EVENT_REQUEST_METHOD_OTHER |
+                      JourneyLogger::EVENT_REQUEST_METHOD_BASIC_CARD,
+                  buckets[0].min, @"");
+
+  // Make sure that the metrics that required the Payment Request to be shown
+  // are not logged.
+  histogramTester.ExpectTotalCount("PaymentRequest.SelectedPaymentMethod", 0,
+                                   failureBlock);
+  histogramTester.ExpectTotalCount("PaymentRequest.NumberOfSelectionAdds", 0,
+                                   failureBlock);
+  histogramTester.ExpectTotalCount("PaymentRequest.NumberOfSelectionChanges", 0,
+                                   failureBlock);
+  histogramTester.ExpectTotalCount("PaymentRequest.NumberOfSelectionEdits", 0,
+                                   failureBlock);
+  histogramTester.ExpectTotalCount("PaymentRequest.NumberOfSuggestionsShown", 0,
+                                   failureBlock);
+}
+
+- (void)testUserHadCompleteSuggestionsForEverything {
+  chrome_test_util::HistogramTester histogramTester;
+
+  [self addProfiles];
+  [self addCard1];
+
+  [self loadTestPage:"payment_request_email_test.html"];
+  [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
+
+  // Navigate away to abort the Payment Request and trigger the logs.
+  [self loadTestPage:"payment_request_email_test.html"];
+
+  // Make sure the correct events were logged.
+  std::vector<chrome_test_util::Bucket> buckets =
+      histogramTester.GetAllSamples("PaymentRequest.Events");
+  GREYAssertEqual(1U, buckets.size(), @"Exactly one bucket");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_SHOWN, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_PAY_CLICKED, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SKIPPED_SHOW, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_COMPLETED, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
+  GREYAssertTrue(
+      buckets[0].min & JourneyLogger::EVENT_HAD_INITIAL_FORM_OF_PAYMENT, @"");
+  GREYAssertTrue(
+      buckets[0].min & JourneyLogger::EVENT_HAD_NECESSARY_COMPLETE_SUGGESTIONS,
+      @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_SHIPPING, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_NAME,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_PHONE,
+                  @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_EMAIL,
+                 @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_CAN_MAKE_PAYMENT_FALSE,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_CAN_MAKE_PAYMENT_TRUE,
+                  @"");
+  GREYAssertTrue(
+      buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_BASIC_CARD, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_GOOGLE,
+                  @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_OTHER,
+                 @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_CREDIT_CARD,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_GOOGLE, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_OTHER, @"");
+}
+
+- (void)testUserHadIncompleteSuggestionsForEverything_NoCard {
+  chrome_test_util::HistogramTester histogramTester;
+
+  [self addProfiles];  // The user has no form of payment on file.
+
+  [self loadTestPage:"payment_request_email_test.html"];
+  [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
+
+  // Navigate away to abort the Payment Request and trigger the logs.
+  [self loadTestPage:"payment_request_email_test.html"];
+
+  // Make sure the correct events were logged.
+  std::vector<chrome_test_util::Bucket> buckets =
+      histogramTester.GetAllSamples("PaymentRequest.Events");
+  GREYAssertEqual(1U, buckets.size(), @"Exactly one bucket");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_SHOWN, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_PAY_CLICKED, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SKIPPED_SHOW, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_COMPLETED, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_HAD_INITIAL_FORM_OF_PAYMENT, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_HAD_NECESSARY_COMPLETE_SUGGESTIONS,
+      @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_SHIPPING, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_NAME,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_PHONE,
+                  @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_EMAIL,
+                 @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_CAN_MAKE_PAYMENT_FALSE,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_CAN_MAKE_PAYMENT_TRUE,
+                  @"");
+  GREYAssertTrue(
+      buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_BASIC_CARD, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_GOOGLE,
+                  @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_OTHER,
+                 @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_CREDIT_CARD,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_GOOGLE, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_OTHER, @"");
+}
+
+- (void)testUserHadIncompleteSuggestionsForEverything_CardNetworkNotSupported {
+  chrome_test_util::HistogramTester histogramTester;
+
+  [self addProfiles];
+  [self addCard2];  // AMEX is not supported by the merchant.
+
+  [self loadTestPage:"payment_request_email_test.html"];
+  [ChromeEarlGrey tapWebViewElementWithID:@"buy"];
+
+  // Navigate away to abort the Payment Request and trigger the logs.
+  [self loadTestPage:"payment_request_email_test.html"];
+
+  // Make sure the correct events were logged.
+  std::vector<chrome_test_util::Bucket> buckets =
+      histogramTester.GetAllSamples("PaymentRequest.Events");
+  GREYAssertEqual(1U, buckets.size(), @"Exactly one bucket");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_SHOWN, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_PAY_CLICKED, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SKIPPED_SHOW, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_COMPLETED, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_HAD_INITIAL_FORM_OF_PAYMENT, @"");
+  GREYAssertFalse(
+      buckets[0].min & JourneyLogger::EVENT_HAD_NECESSARY_COMPLETE_SUGGESTIONS,
+      @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_SHIPPING, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_NAME,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_PHONE,
+                  @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_REQUEST_PAYER_EMAIL,
+                 @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_CAN_MAKE_PAYMENT_FALSE,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_CAN_MAKE_PAYMENT_TRUE,
+                  @"");
+  GREYAssertTrue(
+      buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_BASIC_CARD, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_GOOGLE,
+                  @"");
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_REQUEST_METHOD_OTHER,
+                 @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_CREDIT_CARD,
+                  @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_GOOGLE, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SELECTED_OTHER, @"");
+}
+
 @end

diff --git a/ios/chrome/browser/ui/payments/payment_request_manager.mm b/ios/chrome/browser/ui/payments/payment_request_manager.mm
index 520a40f..c9e778f 100644
--- a/ios/chrome/browser/ui/payments/payment_request_manager.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_manager.mm

@@ -62,6 +62,7 @@
 #include "ios/web/public/ssl_status.h"
 #import "ios/web/public/url_scheme_util.h"
 #import "ios/web/public/web_state/js/crw_js_injection_receiver.h"
+#import "ios/web/public/web_state/navigation_context.h"
 #import "ios/web/public/web_state/ui/crw_web_view_proxy.h"
 #include "ios/web/public/web_state/url_verification_constants.h"
 #include "ios/web/public/web_state/web_state.h"
@@ -163,11 +164,22 @@
 @property(nonatomic, strong, nullable)
     ProceduralBlock coordinatorDidStopCallback;
 
-// Terminates the pending request with |errorMessage| and dismisses the UI.
-// Invokes the callback once the request has been terminated.
-- (void)terminatePendingRequestWithErrorMessage:(NSString*)errorMessage
-                                       callback:
-                                           (ProceduralBlockWithBool)callback;
+// Dismisses the UI, rejects the pending request promise with "AbortError" and
+// |errorMessage|, and records |reason| for the pending request. Invokes
+// |callback| once request promise is rejected.
+- (void)abortPendingRequestWithReason:
+            (payments::JourneyLogger::AbortReason)reason
+                         errorMessage:(NSString*)errorMessage
+                             callback:(ProceduralBlockWithBool)callback;
+
+// Rejects the pending request promise with |errorName| and |errorMessage|, and
+// records |reason| for |paymentRequest|. Invokes |callback| once request
+// promise is rejected. |paymentRequest| may be nil.
+- (void)abortPaymentRequest:(payments::PaymentRequest*)paymentRequest
+                     reason:(payments::JourneyLogger::AbortReason)reason
+                  errorName:(NSString*)errorName
+               errorMessage:(NSString*)errorMessage
+                   callback:(ProceduralBlockWithBool)callback;
 
 // Handler for injected JavaScript callbacks.
 - (BOOL)handleScriptCommand:(const base::DictionaryValue&)JSONCommand;
@@ -295,6 +307,15 @@
 }
 
 - (void)stopTrackingWebState:(web::WebState*)webState {
+  for (const auto& paymentRequest :
+       _paymentRequestCache->GetPaymentRequests(_activeWebState)) {
+    if (paymentRequest->state() != payments::PaymentRequest::State::CLOSED) {
+      paymentRequest->journey_logger().SetAborted(
+          payments::JourneyLogger::ABORT_REASON_USER_NAVIGATION);
+      paymentRequest->set_updating(false);
+      paymentRequest->set_state(payments::PaymentRequest::State::CLOSED);
+    }
+  }
   // The lifetime of a PaymentRequest is tied to the WebState it is associated
   // with and the current URL. Therefore, PaymentRequest instances should get
   // destroyed when the WebState goes away.
@@ -321,35 +342,51 @@
     return;
   }
 
-  _pendingPaymentRequest->journey_logger().SetAborted(
-      payments::JourneyLogger::ABORT_REASON_MERCHANT_NAVIGATION);
-
-  [self terminatePendingRequestWithErrorMessage:kCancelErrorMessage
-                                       callback:nil];
+  [self abortPendingRequestWithReason:payments::JourneyLogger::
+                                          ABORT_REASON_MERCHANT_NAVIGATION
+                         errorMessage:kCancelErrorMessage
+                             callback:nil];
 }
 
-- (void)terminatePendingRequestWithErrorMessage:(NSString*)errorMessage
-                                       callback:
-                                           (ProceduralBlockWithBool)callback {
+- (void)abortPendingRequestWithReason:
+            (payments::JourneyLogger::AbortReason)reason
+                         errorMessage:(NSString*)errorMessage
+                             callback:(ProceduralBlockWithBool)callback {
   DCHECK(_pendingPaymentRequest);
   DCHECK(_pendingPaymentRequest->state() ==
          payments::PaymentRequest::State::INTERACTIVE);
 
-  _pendingPaymentRequest->set_updating(false);
-  _pendingPaymentRequest->set_state(payments::PaymentRequest::State::CLOSED);
-  _pendingPaymentRequest = nullptr;
   [self resetIOSPaymentInstrumentLauncherDelegate];
 
   __weak PaymentRequestManager* weakSelf = self;
   ProceduralBlock dismissUICallback = ^() {
-    [weakSelf.paymentRequestJsManager
-        rejectRequestPromiseWithErrorName:kAbortError
-                             errorMessage:errorMessage
-                        completionHandler:callback];
+    [weakSelf abortPaymentRequest:weakSelf.pendingPaymentRequest
+                           reason:reason
+                        errorName:kAbortError
+                     errorMessage:errorMessage
+                         callback:callback];
+    weakSelf.pendingPaymentRequest = nullptr;
   };
   [self dismissUIWithCallback:dismissUICallback];
 }
 
+- (void)abortPaymentRequest:(payments::PaymentRequest*)paymentRequest
+                     reason:(payments::JourneyLogger::AbortReason)reason
+                  errorName:(NSString*)errorName
+               errorMessage:(NSString*)errorMessage
+                   callback:(ProceduralBlockWithBool)callback {
+  if (paymentRequest &&
+      paymentRequest->state() != payments::PaymentRequest::State::CLOSED) {
+    paymentRequest->journey_logger().SetAborted(reason);
+    paymentRequest->set_updating(false);
+    paymentRequest->set_state(payments::PaymentRequest::State::CLOSED);
+  }
+
+  [_paymentRequestJsManager rejectRequestPromiseWithErrorName:errorName
+                                                 errorMessage:errorMessage
+                                            completionHandler:callback];
+}
+
 - (void)resetIOSPaymentInstrumentLauncherDelegate {
   payments::IOSPaymentInstrumentLauncher* paymentAppLauncher =
       payments::IOSPaymentInstrumentLauncherFactory::GetInstance()
@@ -474,63 +511,63 @@
   return YES;
 }
 
-- (void)abortPaymentRequest:(payments::PaymentRequest*)paymentRequest
-                abortReason:(payments::JourneyLogger::AbortReason)abortReason
-                  errorName:(NSString*)errorName
-               errorMessage:(NSString*)errorMessage
-          completionHandler:(ProceduralBlockWithBool)completionHandler {
-  LOG(ERROR) << "Request promise rejected (" << abortReason
-             << "): " << base::SysNSStringToUTF16(errorName) << ":"
-             << base::SysNSStringToUTF16(errorMessage);
-
-  paymentRequest->journey_logger().SetAborted(abortReason);
-
-  [_paymentRequestJsManager
-      rejectRequestPromiseWithErrorName:errorName
-                           errorMessage:errorMessage
-                      completionHandler:completionHandler];
-}
-
 - (BOOL)handleRequestShow:(const base::DictionaryValue&)message {
   payments::PaymentRequest* paymentRequest =
       [self paymentRequestFromMessage:message];
   if (!paymentRequest) {
     LOG(ERROR) << "Request promise rejected: "
                << base::SysNSStringToUTF16(kInvalidStateError)
-               << ": Unable to get PaymentRequest from message";
-    [_paymentRequestJsManager
-        rejectRequestPromiseWithErrorName:kInvalidStateError
-                             errorMessage:@"Cannot show the payment request"
-                        completionHandler:nil];
+               << "Cannot show the payment request";
+    [self abortPaymentRequest:nil
+                       reason:payments::JourneyLogger::ABORT_REASON_OTHER
+                    errorName:kInvalidStateError
+                 errorMessage:@"Cannot show the payment request"
+                     callback:nil];
     return YES;
   }
 
   if (![self webStateContentIsSecureHTML]) {
+    paymentRequest->journey_logger().SetNotShown(
+        payments::JourneyLogger::NOT_SHOWN_REASON_OTHER);
+
+    LOG(ERROR) << "Request promise rejected: "
+               << base::SysNSStringToUTF16(kNotSupportedError)
+               << "Must be in a secure context";
     [self abortPaymentRequest:paymentRequest
-                  abortReason:payments::JourneyLogger::ABORT_REASON_OTHER
+                       reason:payments::JourneyLogger::ABORT_REASON_OTHER
                     errorName:kNotSupportedError
                  errorMessage:@"Must be in a secure context"
-            completionHandler:nil];
+                     callback:nil];
     return YES;
   }
 
   if (paymentRequest->state() != payments::PaymentRequest::State::CREATED) {
+    paymentRequest->journey_logger().SetNotShown(
+        payments::JourneyLogger::NOT_SHOWN_REASON_OTHER);
+
+    LOG(ERROR) << "Request promise rejected: "
+               << base::SysNSStringToUTF16(kInvalidStateError)
+               << "Already called show() once";
     [self abortPaymentRequest:paymentRequest
-                  abortReason:payments::JourneyLogger::ABORT_REASON_OTHER
+                       reason:payments::JourneyLogger::ABORT_REASON_OTHER
                     errorName:kInvalidStateError
                  errorMessage:@"Already called show() once"
-            completionHandler:nil];
+                     callback:nil];
     return YES;
   }
 
   if (_pendingPaymentRequest) {
     paymentRequest->journey_logger().SetNotShown(
         payments::JourneyLogger::NOT_SHOWN_REASON_CONCURRENT_REQUESTS);
-    [self abortPaymentRequest:paymentRequest
-                  abortReason:payments::JourneyLogger::ABORT_REASON_OTHER
-                    errorName:kAbortError
-                 errorMessage:@"Only one PaymentRequest may be shown at a time"
-            completionHandler:nil];
+
+    LOG(ERROR) << "Request promise rejected: "
+               << base::SysNSStringToUTF16(kAbortError)
+               << "Only one PaymentRequest may be shown at a time";
+    [self abortPendingRequestWithReason:payments::JourneyLogger::
+                                            ABORT_REASON_OTHER
+                           errorMessage:
+                               @"Only one PaymentRequest may be shown at a time"
+                               callback:nil];
     return YES;
   }
 
@@ -540,11 +577,15 @@
        paymentRequest->url_payment_method_identifiers().empty())) {
     paymentRequest->journey_logger().SetNotShown(
         payments::JourneyLogger::NOT_SHOWN_REASON_NO_SUPPORTED_PAYMENT_METHOD);
+
+    LOG(ERROR) << "Request promise rejected: "
+               << base::SysNSStringToUTF16(kNotSupportedError)
+               << "The payment method is not supported";
     [self abortPaymentRequest:paymentRequest
-                  abortReason:payments::JourneyLogger::ABORT_REASON_OTHER
+                       reason:payments::JourneyLogger::ABORT_REASON_OTHER
                     errorName:kNotSupportedError
                  errorMessage:@"The payment method is not supported"
-            completionHandler:nil];
+                     callback:nil];
     return YES;
   }
 
@@ -591,24 +632,22 @@
     return YES;
   }
 
-  _pendingPaymentRequest->journey_logger().SetAborted(
-      payments::JourneyLogger::ABORT_REASON_ABORTED_BY_MERCHANT);
-
   [_unblockEventQueueTimer invalidate];
   [_paymentResponseTimeoutTimer invalidate];
   [_updateEventTimeoutTimer invalidate];
 
   __weak PaymentRequestManager* weakSelf = self;
-
   ProceduralBlockWithBool cancellationCallback = ^(BOOL) {
     [[weakSelf paymentRequestJsManager]
         resolveAbortPromiseWithCompletionHandler:nil];
   };
 
   ProceduralBlock callback = ^{
-    [weakSelf terminatePendingRequestWithErrorMessage:
-                  @"The website has aborted the payment"
-                                             callback:cancellationCallback];
+    [weakSelf
+        abortPendingRequestWithReason:payments::JourneyLogger::
+                                          ABORT_REASON_ABORTED_BY_MERCHANT
+                         errorMessage:@"The website has aborted the payment"
+                             callback:cancellationCallback];
   };
 
   [_paymentRequestCoordinator displayErrorWithCallback:callback];
@@ -627,18 +666,19 @@
     return YES;
   }
 
-  if (![self webStateContentIsSecureHTML]) {
-    [_paymentRequestJsManager resolveCanMakePaymentPromiseWithValue:NO
-                                                  completionHandler:nil];
-    paymentRequest->journey_logger().SetCanMakePaymentValue(false);
-    return YES;
-  }
-
   if (paymentRequest->state() != payments::PaymentRequest::State::CREATED) {
     [_paymentRequestJsManager
         rejectCanMakePaymentPromiseWithErrorName:kInvalidStateError
                                     errorMessage:@"Cannot query payment request"
                                completionHandler:nil];
+    return YES;
+  }
+
+  if (![self webStateContentIsSecureHTML]) {
+    [_paymentRequestJsManager resolveCanMakePaymentPromiseWithValue:NO
+                                                  completionHandler:nil];
+    paymentRequest->journey_logger().SetCanMakePaymentValue(false);
+    return YES;
   }
 
   if (paymentRequest->IsIncognito()) {
@@ -684,17 +724,16 @@
     return YES;
   }
 
-  _pendingPaymentRequest->journey_logger().SetAborted(
-      payments::JourneyLogger::ABORT_REASON_ABORTED_BY_USER);
-
   [_unblockEventQueueTimer invalidate];
   [_paymentResponseTimeoutTimer invalidate];
   [_updateEventTimeoutTimer invalidate];
 
   __weak PaymentRequestManager* weakSelf = self;
   ProceduralBlock callback = ^{
-    [weakSelf terminatePendingRequestWithErrorMessage:kCancelErrorMessage
-                                             callback:nil];
+    [weakSelf abortPendingRequestWithReason:payments::JourneyLogger::
+                                                ABORT_REASON_ABORTED_BY_USER
+                               errorMessage:kCancelErrorMessage
+                                   callback:nil];
   };
 
   [_paymentRequestCoordinator displayErrorWithCallback:callback];
@@ -738,6 +777,8 @@
     [_paymentRequestCoordinator displayErrorWithCallback:callback];
   } else {
     _pendingPaymentRequest->journey_logger().SetCompleted();
+    _pendingPaymentRequest->set_updating(false);
+    _pendingPaymentRequest->set_state(payments::PaymentRequest::State::CLOSED);
     _pendingPaymentRequest->RecordUseStats();
     _pendingPaymentRequest->GetPrefService()->SetBoolean(
         payments::kPaymentsFirstTransactionCompleted, true);
@@ -921,25 +962,23 @@
 
 - (void)paymentRequestCoordinatorDidCancel:
     (PaymentRequestCoordinator*)coordinator {
-  coordinator.paymentRequest->journey_logger().SetAborted(
-      payments::JourneyLogger::ABORT_REASON_ABORTED_BY_USER);
-
-  [self terminatePendingRequestWithErrorMessage:kCancelErrorMessage
-                                       callback:nil];
+  [self abortPendingRequestWithReason:payments::JourneyLogger::
+                                          ABORT_REASON_ABORTED_BY_USER
+                         errorMessage:kCancelErrorMessage
+                             callback:nil];
 }
 
 - (void)paymentRequestCoordinatorDidSelectSettings:
     (PaymentRequestCoordinator*)coordinator {
-  coordinator.paymentRequest->journey_logger().SetAborted(
-      payments::JourneyLogger::ABORT_REASON_ABORTED_BY_USER);
-
   __weak PaymentRequestManager* weakSelf = self;
   ProceduralBlockWithBool callback = ^(BOOL) {
     [weakSelf.dispatcher showAutofillSettings];
   };
 
-  [self terminatePendingRequestWithErrorMessage:kCancelErrorMessage
-                                       callback:callback];
+  [self abortPendingRequestWithReason:payments::JourneyLogger::
+                                          ABORT_REASON_ABORTED_BY_USER
+                         errorMessage:kCancelErrorMessage
+                             callback:callback];
 }
 
 - (void)paymentRequestCoordinator:(PaymentRequestCoordinator*)coordinator
@@ -1023,18 +1062,27 @@
 #pragma mark - CRWWebStateObserver methods
 
 - (void)webState:(web::WebState*)webState
-    didCommitNavigationWithDetails:
-        (const web::LoadCommittedDetails&)load_details {
+    didStartNavigation:(web::NavigationContext*)navigation {
   // Reset any pending request.
   if (_pendingPaymentRequest) {
-    _pendingPaymentRequest->journey_logger().SetAborted(
-        payments::JourneyLogger::ABORT_REASON_MERCHANT_NAVIGATION);
     _pendingPaymentRequest = nullptr;
     [self resetIOSPaymentInstrumentLauncherDelegate];
   }
 
   [self dismissUIWithCallback:nil];
 
+  for (const auto& paymentRequest :
+       _paymentRequestCache->GetPaymentRequests(_activeWebState)) {
+    if (paymentRequest->state() != payments::PaymentRequest::State::CLOSED) {
+      paymentRequest->journey_logger().SetAborted(
+          navigation->IsRendererInitiated()
+              ? payments::JourneyLogger::ABORT_REASON_MERCHANT_NAVIGATION
+              : payments::JourneyLogger::ABORT_REASON_USER_NAVIGATION);
+      paymentRequest->set_updating(false);
+      paymentRequest->set_state(payments::PaymentRequest::State::CLOSED);
+    }
+  }
+
   // The lifetime of a PaymentRequest is tied to the WebState it is associated
   // with and the current URL. Therefore, PaymentRequest instances should get
   // destroyed when the WebState goes away or the user navigates to a URL.

diff --git a/ios/chrome/browser/ui/settings/settings_utils.h b/ios/chrome/browser/ui/settings/settings_utils.h
index 68b249d..a795c3b 100644
--- a/ios/chrome/browser/ui/settings/settings_utils.h
+++ b/ios/chrome/browser/ui/settings/settings_utils.h

@@ -16,13 +16,4 @@
 ProceduralBlockWithURL BlockToOpenURL(UIResponder* responder,
                                       id<ApplicationCommands> dispatcher);
 
-namespace ios_internal_settings {
-// Returns a ProceduralBlockWithURL that uses the dispatcher and opens url
-// (parameter to the block) in a new tab. Forwards to ::BlockToOpenURL.
-// TODO(crbug.com/677941): remove this declaration once ios_internal code
-// has been fixed to use the function in the global namespace instead.
-ProceduralBlockWithURL BlockToOpenURL(UIResponder* responder,
-                                      id<ApplicationCommands> dispatcher);
-}  // namespace ios_internal_settings
-
 #endif  // IOS_CHROME_BROWSER_UI_SETTINGS_SETTINGS_UTILS_H_

diff --git a/ios/chrome/browser/ui/settings/settings_utils.mm b/ios/chrome/browser/ui/settings/settings_utils.mm
index 382d8e4..d0a8184 100644
--- a/ios/chrome/browser/ui/settings/settings_utils.mm
+++ b/ios/chrome/browser/ui/settings/settings_utils.mm

@@ -25,10 +25,3 @@
   };
   return [blockToOpenURL copy];
 }
-
-namespace ios_internal_settings {
-ProceduralBlockWithURL BlockToOpenURL(UIResponder* responder,
-                                      id<ApplicationCommands> dispatcher) {
-  return ::BlockToOpenURL(responder, dispatcher);
-}
-}  // namespace ios_internal_settings

diff --git a/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm b/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm
index 8a50756..bd2f84f 100644
--- a/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm
+++ b/ios/chrome/browser/ui/toolbar/toolbar_egtest.mm

@@ -7,6 +7,7 @@
 
 #include "base/ios/ios_util.h"
 #include "components/strings/grit/components_strings.h"
+#import "ios/chrome/browser/ui/commands/browser_commands.h"
 #import "ios/chrome/browser/ui/commands/generic_chrome_command.h"
 #include "ios/chrome/browser/ui/commands/ios_command_ids.h"
 #import "ios/chrome/browser/ui/content_suggestions/ntp_home_constant.h"
@@ -46,18 +47,13 @@
       chrome_test_util::GetCurrentNewTabPageController();
   if (IsIPadIdiom()) {
     [ntp_controller selectPanel:panel_type];
-  } else {
-    NSUInteger tag = 0;
-    if (panel_type == ntp_home::BOOKMARKS_PANEL) {
-      tag = IDC_SHOW_BOOKMARK_MANAGER;
-    } else if (panel_type == ntp_home::RECENT_TABS_PANEL) {
-      tag = IDC_SHOW_OTHER_DEVICES;
-    }
-    if (tag) {
-      GenericChromeCommand* command =
-          [[GenericChromeCommand alloc] initWithTag:tag];
-      chrome_test_util::RunCommandWithActiveViewController(command);
-    }
+  } else if (panel_type == ntp_home::BOOKMARKS_PANEL) {
+    [chrome_test_util::BrowserCommandDispatcherForMainBVC()
+        showBookmarksManager];
+  } else if (panel_type == ntp_home::RECENT_TABS_PANEL) {
+    GenericChromeCommand* command =
+        [[GenericChromeCommand alloc] initWithTag:IDC_SHOW_OTHER_DEVICES];
+    chrome_test_util::RunCommandWithActiveViewController(command);
   }
   [[GREYUIThreadExecutor sharedInstance] drainUntilIdle];
 }

diff --git a/ios/chrome/browser/ui/tools_menu/tools_menu_constants.h b/ios/chrome/browser/ui/tools_menu/tools_menu_constants.h
index 2f3dfda..4bdde12 100644
--- a/ios/chrome/browser/ui/tools_menu/tools_menu_constants.h
+++ b/ios/chrome/browser/ui/tools_menu/tools_menu_constants.h

@@ -57,6 +57,7 @@
   TOOLS_REPORT_AN_ISSUE = -16,
   TOOLS_SHOW_FIND_IN_PAGE = -17,
   TOOLS_SHOW_HELP_PAGE = -18,
+  TOOLS_SHOW_BOOKMARKS = -19,
 };
 
 #endif  // IOS_CHROME_BROWSER_UI_TOOLS_MENU_TOOLS_MENU_CONSTANTS_H_

diff --git a/ios/chrome/browser/ui/tools_menu/tools_menu_model.mm b/ios/chrome/browser/ui/tools_menu/tools_menu_model.mm
index 0be585b..6baedbb 100644
--- a/ios/chrome/browser/ui/tools_menu/tools_menu_model.mm
+++ b/ios/chrome/browser/ui/tools_menu/tools_menu_model.mm

@@ -53,7 +53,8 @@
     @selector(closeAllIncognitoTabs), ToolbarTypeSwitcheriPhone,
     kVisibleIncognitoOnly,                nil },
   { IDS_IOS_TOOLS_MENU_BOOKMARKS,         kToolsMenuBookmarksId,
-    IDC_SHOW_BOOKMARK_MANAGER, nullptr,   ToolbarTypeWebAll,
+    TOOLS_SHOW_BOOKMARKS,
+    @selector(showBookmarksManager),      ToolbarTypeWebAll,
     0,                                    nil },
   { IDS_IOS_TOOLS_MENU_READING_LIST,      kToolsMenuReadingListId,
     TOOLS_READING_LIST,

diff --git a/ios/chrome/browser/ui/tools_menu/tools_popup_controller.mm b/ios/chrome/browser/ui/tools_menu/tools_popup_controller.mm
index 771223c..b8d45fab 100644
--- a/ios/chrome/browser/ui/tools_menu/tools_popup_controller.mm
+++ b/ios/chrome/browser/ui/tools_menu/tools_popup_controller.mm

@@ -199,7 +199,7 @@
     case IDC_REQUEST_MOBILE_SITE:
       base::RecordAction(UserMetricsAction("MobileMenuRequestMobileSite"));
       break;
-    case IDC_SHOW_BOOKMARK_MANAGER:
+    case TOOLS_SHOW_BOOKMARKS:
       base::RecordAction(UserMetricsAction("MobileMenuAllBookmarks"));
       break;
     case TOOLS_SHOW_HISTORY:

diff --git a/ios/clean/chrome/browser/ui/commands/BUILD.gn b/ios/clean/chrome/browser/ui/commands/BUILD.gn
index dbca23bf..07e828cc 100644
--- a/ios/clean/chrome/browser/ui/commands/BUILD.gn
+++ b/ios/clean/chrome/browser/ui/commands/BUILD.gn

@@ -8,6 +8,7 @@
     "dialog_commands.h",
     "find_in_page_search_commands.h",
     "find_in_page_visibility_commands.h",
+    "http_auth_dialog_commands.h",
     "java_script_dialog_commands.h",
     "navigation_commands.h",
     "ntp_commands.h",

diff --git a/ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h b/ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h
new file mode 100644
index 0000000..9c1c0db
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h

@@ -0,0 +1,17 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CLEAN_CHROME_BROWSER_UI_COMMANDS_HTTP_AUTH_DIALOG_COMMANDS_H_
+#define IOS_CLEAN_CHROME_BROWSER_UI_COMMANDS_HTTP_AUTH_DIALOG_COMMANDS_H_
+
+// Commands used to dismiss HTTP authentication dialogs.
+@protocol HTTPAuthDialogDismissalCommands<NSObject>
+
+// Called when the HTTP authentication flow has been completed to stop the
+// dialog's coordinator.
+- (void)dismissHTTPAuthDialog;
+
+@end
+
+#endif  // IOS_CLEAN_CHROME_BROWSER_UI_COMMANDS_HTTP_AUTH_DIALOG_COMMANDS_H_

diff --git a/ios/clean/chrome/browser/ui/dialogs/dialog_coordinator_unittest.mm b/ios/clean/chrome/browser/ui/dialogs/dialog_coordinator_unittest.mm
index b040c6f..50f6efd5 100644
--- a/ios/clean/chrome/browser/ui/dialogs/dialog_coordinator_unittest.mm
+++ b/ios/clean/chrome/browser/ui/dialogs/dialog_coordinator_unittest.mm

@@ -16,7 +16,7 @@
 #import "ios/clean/chrome/browser/ui/dialogs/dialog_text_field_configuration.h"
 #import "ios/clean/chrome/browser/ui/dialogs/dialog_view_controller.h"
 #import "ios/clean/chrome/browser/ui/dialogs/test_helpers/test_dialog_mediator.h"
-#import "ios/clean/chrome/browser/ui/overlays/test_helpers/test_overlay_queue.h"
+#import "ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.h"
 #include "ios/web/public/test/fakes/test_browser_state.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
@@ -56,25 +56,17 @@
 @end
 
 // A test fixture for DialogCoordinators.
-class DialogCoordinatorTest : public PlatformTest {
+class DialogCoordinatorTest : public OverlayCoordinatorTest {
  public:
   DialogCoordinatorTest()
-      : PlatformTest(),
-        coordinator_([[TestDialogCoordinator alloc] init]),
-        browser_(ios::ChromeBrowserState::FromBrowserState(&browser_state_)) {
+      : OverlayCoordinatorTest(),
+        coordinator_([[TestDialogCoordinator alloc] init]) {
     // DialogConsumers require at least one button.
     coordinator_.testMediator.buttonConfigs = @[ [DialogButtonConfiguration
         configWithText:@"OK"
                  style:DialogButtonStyle::DEFAULT] ];
-    // Add the coordinator to the queue.
-    queue_.SetBrowser(&browser_);
-    queue_.AddOverlay(coordinator_);
   }
 
-  ~DialogCoordinatorTest() override { queue_.CancelOverlays(); }
-
-  void StartCoordinator() { queue_.StartNextOverlay(); }
-
   DialogViewController* alert_controller() {
     return base::mac::ObjCCastStrict<DialogViewController>(
         coordinator_.viewController);
@@ -82,14 +74,13 @@
 
  protected:
   __strong TestDialogCoordinator* coordinator_;
-  web::TestBrowserState browser_state_;
-  Browser browser_;
-  TestOverlayQueue queue_;
+
+  OverlayCoordinator* GetOverlay() override { return coordinator_; }
 };
 
 // Tests that the alert style is used by default.
 TEST_F(DialogCoordinatorTest, DefaultStyle) {
-  StartCoordinator();
+  StartOverlay();
   ASSERT_TRUE(alert_controller());
   EXPECT_EQ(UIAlertControllerStyleAlert, alert_controller().preferredStyle);
 }
@@ -97,7 +88,7 @@
 // Tests that the action sheet style is used if specified.
 TEST_F(DialogCoordinatorTest, ActionSheetStyle) {
   coordinator_.alertStyle = UIAlertControllerStyleActionSheet;
-  StartCoordinator();
+  StartOverlay();
   ASSERT_TRUE(alert_controller());
   EXPECT_EQ(UIAlertControllerStyleActionSheet,
             alert_controller().preferredStyle);

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/BUILD.gn b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/BUILD.gn
new file mode 100644
index 0000000..2f41389
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/BUILD.gn

@@ -0,0 +1,67 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("http_auth_dialogs") {
+  sources = [
+    "http_auth_dialog_coordinator.h",
+    "http_auth_dialog_coordinator.mm",
+    "http_auth_dialog_mediator.h",
+    "http_auth_dialog_mediator.mm",
+    "http_auth_dialog_request.h",
+    "http_auth_dialog_request.mm",
+  ]
+
+  configs += [ "//build/config/compiler:enable_arc" ]
+
+  deps = [
+    "//components/strings",
+    "//ios/chrome/app/strings",
+    "//ios/chrome/browser/ui/browser_list",
+    "//ios/chrome/browser/ui/commands",
+    "//ios/chrome/browser/ui/coordinators",
+    "//ios/clean/chrome/browser/ui/commands",
+    "//ios/clean/chrome/browser/ui/dialogs:dialog_coordinator_support",
+    "//ios/clean/chrome/browser/ui/dialogs:dialogs_ui",
+    "//ios/clean/chrome/browser/ui/overlays",
+    "//ios/shared/chrome/browser/ui/dialogs",
+    "//ios/web",
+    "//ui/base",
+    "//url",
+  ]
+}
+
+source_set("unit_tests") {
+  testonly = true
+  sources = [
+    "http_auth_dialog_coordinator_unittest.mm",
+    "http_auth_dialog_mediator_unittest.mm",
+    "http_auth_dialog_request_unittest.mm",
+  ]
+
+  configs += [ "//build/config/compiler:enable_arc" ]
+
+  deps = [
+    ":http_auth_dialogs",
+    "//base",
+    "//base/test:test_support",
+    "//components/strings:components_strings_grit",
+    "//ios/chrome/app/strings:ios_strings_grit",
+    "//ios/chrome/browser/browser_state",
+    "//ios/chrome/browser/ui/browser_list",
+    "//ios/chrome/browser/ui/coordinators",
+    "//ios/chrome/browser/web_state_list",
+    "//ios/chrome/test/base",
+    "//ios/clean/chrome/browser/ui/commands",
+    "//ios/clean/chrome/browser/ui/dialogs:dialog_coordinator_support",
+    "//ios/clean/chrome/browser/ui/dialogs:dialogs_ui",
+    "//ios/clean/chrome/browser/ui/dialogs/test_helpers",
+    "//ios/clean/chrome/browser/ui/overlays/test_helpers",
+    "//ios/shared/chrome/browser/ui/dialogs",
+    "//ios/web",
+    "//ios/web/public/test",
+    "//ios/web/public/test/fakes",
+    "//testing/gtest",
+    "//ui/base",
+  ]
+}

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.h b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.h
new file mode 100644
index 0000000..23331de7
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.h

@@ -0,0 +1,25 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_COORDINATOR_H_
+#define IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_COORDINATOR_H_
+
+#import <Foundation/Foundation.h>
+
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_coordinator.h"
+
+@class HTTPAuthDialogRequest;
+
+// A coordinator for the UI elements used to present HTTP authentication
+// dialogs.
+@interface HTTPAuthDialogCoordinator : DialogCoordinator
+
+// Designated initializer to display a HTTP authentication dialog for |request|.
+- (nullable instancetype)initWithRequest:(nonnull HTTPAuthDialogRequest*)request
+    NS_DESIGNATED_INITIALIZER;
+- (nullable instancetype)init NS_UNAVAILABLE;
+
+@end
+
+#endif  // IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_COORDINATOR_H_

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.mm b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.mm
new file mode 100644
index 0000000..5a3fba69d
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.mm

@@ -0,0 +1,88 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.h"
+
+#include "base/logging.h"
+#import "ios/chrome/browser/ui/browser_list/browser.h"
+#import "ios/chrome/browser/ui/commands/command_dispatcher.h"
+#import "ios/chrome/browser/ui/coordinators/browser_coordinator+internal.h"
+#import "ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_coordinator+subclassing.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface HTTPAuthDialogCoordinator ()<HTTPAuthDialogDismissalCommands> {
+  // Backing object for property of same name (from Subclassing category).
+  HTTPAuthDialogMediator* _mediator;
+}
+
+// The dispatcher to provide to the mediator.
+@property(nonatomic, readonly, strong) id<HTTPAuthDialogDismissalCommands>
+    dismissalDispatcher;
+// The request used for this dialog.
+@property(nonatomic, strong) HTTPAuthDialogRequest* request;
+
+@end
+
+@implementation HTTPAuthDialogCoordinator
+@synthesize request = _request;
+
+- (instancetype)initWithRequest:(HTTPAuthDialogRequest*)request {
+  DCHECK(request);
+  if ((self = [super init])) {
+    _request = request;
+  }
+  return self;
+}
+
+#pragma mark - Accessors
+
+- (id<HTTPAuthDialogDismissalCommands>)dismissalDispatcher {
+  return static_cast<id<HTTPAuthDialogDismissalCommands>>(
+      self.browser->dispatcher());
+}
+
+#pragma mark - BrowserCoordinator
+
+- (void)start {
+  _mediator = [[HTTPAuthDialogMediator alloc] initWithRequest:self.request];
+  _mediator.dispatcher = self.dismissalDispatcher;
+  [self.browser->dispatcher()
+      startDispatchingToTarget:self
+                   forProtocol:@protocol(HTTPAuthDialogDismissalCommands)];
+  [super start];
+}
+
+- (void)stop {
+  if (self.started)
+    [self.browser->dispatcher() stopDispatchingToTarget:self];
+  [super stop];
+}
+
+#pragma mark - OverlayCoordinator
+
+- (void)cancelOverlay {
+  [self.request completeAuthenticationWithUsername:nil password:nil];
+}
+
+#pragma mark - HTTPAuthDialogDismissalCommands
+
+- (void)dismissHTTPAuthDialog {
+  [self stop];
+}
+
+@end
+
+@implementation HTTPAuthDialogCoordinator (DialogCoordinatorSubclassing)
+
+- (DialogMediator*)mediator {
+  return _mediator;
+}
+
+@end

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator_unittest.mm b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator_unittest.mm
new file mode 100644
index 0000000..3eb6059
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator_unittest.mm

@@ -0,0 +1,51 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.h"
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+#import "ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/gtest_mac.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+// A test fixture for HTTPAuthDialogCoordinators.
+class HTTPAuthDialogCoordinatorTest : public OverlayCoordinatorTest {
+ public:
+  HTTPAuthDialogCoordinatorTest() : OverlayCoordinatorTest() {
+    NSURLProtectionSpace* protection_space =
+        [[NSURLProtectionSpace alloc] initWithHost:@"host"
+                                              port:8080
+                                          protocol:@"protocol"
+                                             realm:@"realm"
+                              authenticationMethod:@"authMethod"];
+    NSURLCredential* credential = [[NSURLCredential alloc]
+        initWithUser:@"user"
+            password:@"password"
+         persistence:NSURLCredentialPersistencePermanent];
+    HTTPAuthDialogRequest* request =
+        [HTTPAuthDialogRequest requestWithWebState:&web_state_
+                                   protectionSpace:protection_space
+                                        credential:credential
+                                          callback:^(NSString*, NSString*){
+                                              // no-op.
+                                          }];
+    coordinator_ = [[HTTPAuthDialogCoordinator alloc] initWithRequest:request];
+  }
+
+ protected:
+  web::TestWebState web_state_;
+  __strong HTTPAuthDialogCoordinator* coordinator_;
+
+  OverlayCoordinator* GetOverlay() override { return coordinator_; }
+};
+
+// Tests that an HTTPAuthDialogCoordinator can be initialized and started.
+TEST_F(HTTPAuthDialogCoordinatorTest, InitAndStart) {
+  StartOverlay();
+}

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.h b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.h
new file mode 100644
index 0000000..d521186b
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.h

@@ -0,0 +1,28 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_MEDIATOR_H_
+#define IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_MEDIATOR_H_
+
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_mediator.h"
+
+@protocol HTTPAuthDialogDismissalCommands;
+@class HTTPAuthDialogRequest;
+
+// Class responsible for setting up a DialogConsumer for HTTP auth dialogs.
+@interface HTTPAuthDialogMediator : DialogMediator
+
+// Designated initializer for a mediator that uses |request| to provide data to
+// consumers, and |dispatcher| to communicate HTTP auth dismissal commands.
+- (nullable instancetype)initWithRequest:(nonnull HTTPAuthDialogRequest*)request
+    NS_DESIGNATED_INITIALIZER;
+- (nullable instancetype)init NS_UNAVAILABLE;
+
+// The dispatcher to use for dismissal.
+@property(nonatomic, weak, nullable) id<HTTPAuthDialogDismissalCommands>
+    dispatcher;
+
+@end
+
+#endif  // IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_MEDIATOR_H_

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.mm b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.mm
new file mode 100644
index 0000000..13a7eb1
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.mm

@@ -0,0 +1,116 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.h"
+
+#include "base/logging.h"
+#include "components/strings/grit/components_strings.h"
+#import "ios/chrome/browser/ui/commands/command_dispatcher.h"
+#include "ios/chrome/grit/ios_strings.h"
+#import "ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_button_configuration.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_button_style.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_consumer.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_mediator+subclassing.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_text_field_configuration.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+#include "ui/base/l10n/l10n_util.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface HTTPAuthDialogMediator ()
+
+// The request for this dialog.
+@property(nonatomic, readonly, strong) HTTPAuthDialogRequest* request;
+// Dialog configuration identifiers.
+@property(nonatomic, weak) DialogConfigurationIdentifier* OKButtonID;
+@property(nonatomic, weak) DialogConfigurationIdentifier* cancelButtonID;
+@property(nonatomic, weak) DialogConfigurationIdentifier* usernameTextFieldID;
+@property(nonatomic, weak) DialogConfigurationIdentifier* passwordTextFieldID;
+
+@end
+
+@implementation HTTPAuthDialogMediator
+@synthesize dispatcher = _dispatcher;
+@synthesize request = _request;
+@synthesize OKButtonID = _OKButtonID;
+@synthesize cancelButtonID = cancelButtonID;
+@synthesize usernameTextFieldID = usernameTextFieldID;
+@synthesize passwordTextFieldID = _passwordTextFieldID;
+
+- (instancetype)initWithRequest:(HTTPAuthDialogRequest*)request {
+  DCHECK(request);
+  if ((self = [super init])) {
+    _request = request;
+  }
+  return self;
+}
+
+#pragma mark - DialogDismissalCommands
+
+- (void)dismissDialogWithButtonID:(id)buttonID
+                  textFieldValues:
+                      (NSDictionary<id, NSString*>*)textFieldValues {
+  NSString* username = nil;
+  NSString* password = nil;
+  if (buttonID == self.OKButtonID) {
+    username = textFieldValues[self.usernameTextFieldID];
+    username = username ? username : @"";
+    password = textFieldValues[self.passwordTextFieldID];
+    password = password ? password : @"";
+  } else if (buttonID == self.cancelButtonID) {
+    // Use nil in callbacks for cancelled HTTP auth dialogs.
+  } else {
+    NOTREACHED() << "Received dialog dismissal for unknown button ID.";
+  }
+  [self.request completeAuthenticationWithUsername:username password:password];
+  [self.dispatcher dismissHTTPAuthDialog];
+}
+
+@end
+
+@implementation HTTPAuthDialogMediator (DialogMediatorSubclassing)
+
+- (NSString*)dialogTitle {
+  return self.request.title;
+}
+
+- (NSString*)dialogMessage {
+  return self.request.message;
+}
+
+- (NSArray<DialogButtonConfiguration*>*)buttonConfigs {
+  DialogButtonConfiguration* OKButtonConfig =
+      [DialogButtonConfiguration configWithText:l10n_util::GetNSString(IDS_OK)
+                                          style:DialogButtonStyle::DEFAULT];
+  self.OKButtonID = OKButtonConfig.identifier;
+  DialogButtonConfiguration* cancelButtonConfig = [DialogButtonConfiguration
+      configWithText:l10n_util::GetNSString(IDS_CANCEL)
+               style:DialogButtonStyle::CANCEL];
+  self.cancelButtonID = cancelButtonConfig.identifier;
+  return @[ OKButtonConfig, cancelButtonConfig ];
+}
+
+- (NSArray<DialogTextFieldConfiguration*>*)textFieldConfigs {
+  NSString* defaultUsername = self.request.defaultUserNameText;
+  NSString* usernamePlaceholder =
+      l10n_util::GetNSString(IDS_IOS_HTTP_LOGIN_DIALOG_USERNAME_PLACEHOLDER);
+  DialogTextFieldConfiguration* usernameConfig =
+      [DialogTextFieldConfiguration configWithDefaultText:defaultUsername
+                                          placeholderText:usernamePlaceholder
+                                                   secure:NO];
+  self.usernameTextFieldID = usernameConfig.identifier;
+  NSString* passwordPlaceholder =
+      l10n_util::GetNSString(IDS_IOS_HTTP_LOGIN_DIALOG_PASSWORD_PLACEHOLDER);
+  DialogTextFieldConfiguration* passwordConfig =
+      [DialogTextFieldConfiguration configWithDefaultText:nil
+                                          placeholderText:passwordPlaceholder
+                                                   secure:YES];
+  self.passwordTextFieldID = passwordConfig.identifier;
+  return @[ usernameConfig, passwordConfig ];
+}
+
+@end

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator_unittest.mm b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator_unittest.mm
new file mode 100644
index 0000000..023bce0
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator_unittest.mm

@@ -0,0 +1,106 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_mediator.h"
+
+#import "base/mac/foundation_util.h"
+#include "components/strings/grit/components_strings.h"
+#include "ios/chrome/grit/ios_strings.h"
+#import "ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_button_configuration.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_button_style.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_mediator+subclassing.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_text_field_configuration.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+#import "ios/clean/chrome/browser/ui/dialogs/test_helpers/dialog_test_util.h"
+#import "ios/clean/chrome/browser/ui/dialogs/test_helpers/test_dialog_view_controller.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/gtest_mac.h"
+#include "testing/platform_test.h"
+#include "ui/base/l10n/l10n_util.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+// Tests whether |button| uses |style| and |text|
+void TestButtonConfig(DialogButtonConfiguration* button,
+                      DialogButtonStyle style,
+                      NSString* text) {
+  EXPECT_EQ(button.style, style);
+  EXPECT_NSEQ(button.text, text);
+}
+// Tests whether |text_field| uses |default_text| and |placeholder_text| and is
+// |secure|.
+void TestTextFieldConfig(DialogTextFieldConfiguration* text_field,
+                         NSString* default_text,
+                         NSString* placeholder_text,
+                         bool secure) {
+  EXPECT_NSEQ(text_field.defaultText, default_text);
+  EXPECT_NSEQ(text_field.placeholderText, placeholder_text);
+  EXPECT_EQ(text_field.secure, secure);
+}
+}  // namespace
+
+// A test fixture for HTTPAuthDialogMediators.
+class HTTPAuthDialogMediatorTest : public PlatformTest {
+ public:
+  HTTPAuthDialogMediatorTest() {
+    NSURLProtectionSpace* protection_space =
+        [[NSURLProtectionSpace alloc] initWithHost:@"host"
+                                              port:8080
+                                          protocol:@"protocol"
+                                             realm:@"realm"
+                              authenticationMethod:@"authMethod"];
+    NSURLCredential* credential = [[NSURLCredential alloc]
+        initWithUser:@"user"
+            password:@"password"
+         persistence:NSURLCredentialPersistencePermanent];
+    request_ =
+        [HTTPAuthDialogRequest requestWithWebState:&web_state_
+                                   protectionSpace:protection_space
+                                        credential:credential
+                                          callback:^(NSString*, NSString*){
+                                              // no-op.
+                                          }];
+    mediator_ = [[HTTPAuthDialogMediator alloc] initWithRequest:request_];
+  }
+
+  ~HTTPAuthDialogMediatorTest() override {
+    [request_ completeAuthenticationWithUsername:nil password:nil];
+  }
+
+  HTTPAuthDialogRequest* request() { return request_; }
+  NSArray<DialogButtonConfiguration*>* buttons() {
+    return [mediator_ buttonConfigs];
+  }
+  NSArray<DialogTextFieldConfiguration*>* text_fields() {
+    return [mediator_ textFieldConfigs];
+  }
+
+ private:
+  web::TestWebState web_state_;
+  __strong HTTPAuthDialogRequest* request_;
+  __strong HTTPAuthDialogMediator* mediator_;
+};
+
+// Tests that the appropriate buttons and text fields have been added.
+TEST_F(HTTPAuthDialogMediatorTest, Alert) {
+  EXPECT_EQ(buttons().count, 2U);
+  TestButtonConfig(buttons()[0], DialogButtonStyle::DEFAULT,
+                   l10n_util::GetNSString(IDS_OK));
+  TestButtonConfig(buttons()[1], DialogButtonStyle::CANCEL,
+                   l10n_util::GetNSString(IDS_CANCEL));
+  EXPECT_EQ(text_fields().count, 2U);
+  TestTextFieldConfig(
+      text_fields()[0], request().defaultUserNameText,
+      l10n_util::GetNSString(IDS_IOS_HTTP_LOGIN_DIALOG_USERNAME_PLACEHOLDER),
+      false);
+  TestTextFieldConfig(
+      text_fields()[1], nil,
+      l10n_util::GetNSString(IDS_IOS_HTTP_LOGIN_DIALOG_PASSWORD_PLACEHOLDER),
+      true);
+}

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h
new file mode 100644
index 0000000..d5121c2b
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h

@@ -0,0 +1,55 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_REQUEST_H_
+#define IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_REQUEST_H_
+
+#import <Foundation/Foundation.h>
+
+namespace web {
+class WebState;
+}
+
+// Block type for HTTP authentication callbacks.
+typedef void (^HTTPAuthDialogCallback)(NSString* _Nullable username,
+                                       NSString* _Nullable password);
+
+// A container object encapsulating all the state necessary to support an
+// HTTPAuthDialogCoordiantor.  This object also owns the WebKit
+// completion block that will throw an exception if it is deallocated before
+// being executed. |-runCallbackWithUserName:password:| must be executed once in
+// the lifetime of every HTTPAuthDialogRequest.
+@interface HTTPAuthDialogRequest : NSObject
+
+// Factory method to create HTTPAuthDialogRequests from the given input.  All
+// arguments to this function are expected to be non nil/null.
++ (nullable instancetype)
+requestWithWebState:(nonnull web::WebState*)webState
+    protectionSpace:(nonnull NSURLProtectionSpace*)protectionSpace
+         credential:(nonnull NSURLCredential*)credential
+           callback:(nonnull HTTPAuthDialogCallback)callback;
+- (nullable instancetype)init NS_UNAVAILABLE;
+
+// The WebState displaying this dialog.
+@property(nonatomic, readonly, nonnull) web::WebState* webState;
+
+// The title to use for the dialog.
+@property(nonatomic, readonly, strong, nonnull) NSString* title;
+
+// The authentication message for the dialog's protection space.
+@property(nonatomic, readonly, strong, nonnull) NSString* message;
+
+// The default text to display in the username text field.
+@property(nonatomic, readonly, strong, nonnull) NSString* defaultUserNameText;
+
+// Completes the HTTP authentication flow with the given username and password.
+// If the user taps the OK button, |username| and |password| are expected to be
+// non-nil, even if they are empty strings.  If the user taps the Cancel button,
+// arguments should be nil.
+- (void)completeAuthenticationWithUsername:(nullable NSString*)username
+                                  password:(nullable NSString*)password;
+
+@end
+
+#endif  // IOS_CLEAN_CHROME_BROWSER_UI_DIALOGS_HTTP_AUTH_DIALOGS_HTTP_AUTH_DIALOG_REQUEST_H_

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.mm b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.mm
new file mode 100644
index 0000000..9497676
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.mm

@@ -0,0 +1,84 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+
+#include "base/logging.h"
+#include "components/strings/grit/components_strings.h"
+#include "ios/chrome/grit/ios_strings.h"
+#import "ios/shared/chrome/browser/ui/dialogs/nsurl_protection_space_util.h"
+#include "ui/base/l10n/l10n_util.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface HTTPAuthDialogRequest ()
+
+// The authentication callback provided by WebKit.
+@property(nonatomic, copy) HTTPAuthDialogCallback callback;
+
+// Whether |callback| has been executed.
+@property(nonatomic, assign) BOOL callbackHasBeenExecuted;
+
+// Private initializer used by factory method.
+- (instancetype)initWithWebState:(web::WebState*)webState
+                 protectionSpace:(NSURLProtectionSpace*)protectionSpace
+                      credential:(NSURLCredential*)credential
+                        callback:(HTTPAuthDialogCallback)callback
+    NS_DESIGNATED_INITIALIZER;
+
+@end
+
+@implementation HTTPAuthDialogRequest
+@synthesize webState = _webState;
+@synthesize title = _title;
+@synthesize message = _message;
+@synthesize defaultUserNameText = _defaultUserNameText;
+@synthesize callback = _callback;
+@synthesize callbackHasBeenExecuted = _callbackHasBeenExecuted;
+
+- (instancetype)initWithWebState:(web::WebState*)webState
+                 protectionSpace:(NSURLProtectionSpace*)protectionSpace
+                      credential:(NSURLCredential*)credential
+                        callback:(HTTPAuthDialogCallback)callback {
+  DCHECK(webState);
+  DCHECK(protectionSpace);
+  DCHECK(credential);
+  DCHECK(callback);
+  if ((self = [super init])) {
+    _webState = webState;
+    _title = l10n_util::GetNSStringWithFixup(IDS_LOGIN_DIALOG_TITLE);
+    _message = nsurlprotectionspace_util::MessageForHTTPAuth(protectionSpace);
+    _defaultUserNameText = credential.user ? credential.user : @"";
+    _callback = [callback copy];
+  }
+  return self;
+}
+
+- (void)dealloc {
+  DCHECK(_callbackHasBeenExecuted);
+}
+
+#pragma mark - Public
+
++ (instancetype)requestWithWebState:(web::WebState*)webState
+                    protectionSpace:(NSURLProtectionSpace*)protectionSpace
+                         credential:(NSURLCredential*)credential
+                           callback:(HTTPAuthDialogCallback)callback {
+  return [[self alloc] initWithWebState:webState
+                        protectionSpace:protectionSpace
+                             credential:credential
+                               callback:callback];
+}
+
+- (void)completeAuthenticationWithUsername:(NSString*)username
+                                  password:(NSString*)password {
+  if (self.callbackHasBeenExecuted)
+    return;
+  self.callback(username, password);
+  self.callbackHasBeenExecuted = YES;
+}
+
+@end

diff --git a/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request_unittest.mm b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request_unittest.mm
new file mode 100644
index 0000000..9264e518
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request_unittest.mm

@@ -0,0 +1,91 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+
+#import "base/mac/foundation_util.h"
+#include "components/strings/grit/components_strings.h"
+#include "ios/chrome/grit/ios_strings.h"
+#import "ios/clean/chrome/browser/ui/commands/http_auth_dialog_commands.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_button_configuration.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_button_style.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_mediator+subclassing.h"
+#import "ios/clean/chrome/browser/ui/dialogs/dialog_text_field_configuration.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
+#import "ios/clean/chrome/browser/ui/dialogs/test_helpers/dialog_test_util.h"
+#import "ios/clean/chrome/browser/ui/dialogs/test_helpers/test_dialog_view_controller.h"
+#import "ios/shared/chrome/browser/ui/dialogs/nsurl_protection_space_util.h"
+#import "ios/web/public/test/fakes/test_web_state.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "testing/gtest_mac.h"
+#include "testing/platform_test.h"
+#include "ui/base/l10n/l10n_util.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+// A test fixture for HTTPAuthDialogMediators.
+class HTTPAuthDialogRequestTest : public PlatformTest {
+ public:
+  HTTPAuthDialogRequestTest()
+      : PlatformTest(), callback_username_(nil), callback_password_(nil) {
+    protection_space_ =
+        [[NSURLProtectionSpace alloc] initWithHost:@"host"
+                                              port:8080
+                                          protocol:@"protocol"
+                                             realm:@"realm"
+                              authenticationMethod:@"authMethod"];
+    credential_ = [[NSURLCredential alloc]
+        initWithUser:@"user"
+            password:@"password"
+         persistence:NSURLCredentialPersistencePermanent];
+    request_ = [HTTPAuthDialogRequest
+        requestWithWebState:&web_state_
+            protectionSpace:protection_space_
+                 credential:credential_
+                   callback:^(NSString* username, NSString* password) {
+                     callback_username_ = username;
+                     callback_password_ = password;
+                   }];
+  }
+
+  ~HTTPAuthDialogRequestTest() override {
+    [request_ completeAuthenticationWithUsername:nil password:nil];
+  }
+
+  web::WebState* web_state() { return &web_state_; }
+  NSURLProtectionSpace* protection_space() { return protection_space_; }
+  NSURLCredential* credential() { return credential_; }
+  HTTPAuthDialogRequest* request() { return request_; }
+  NSString* callback_username() { return callback_username_; }
+  NSString* callback_password() { return callback_password_; }
+
+ private:
+  web::TestWebState web_state_;
+  __strong NSURLProtectionSpace* protection_space_;
+  __strong NSURLCredential* credential_;
+  __strong HTTPAuthDialogRequest* request_;
+  __strong NSString* callback_username_;
+  __strong NSString* callback_password_;
+};
+
+// Tests that the factory method creates a request as expected.
+TEST_F(HTTPAuthDialogRequestTest, Factory) {
+  EXPECT_EQ(web_state(), request().webState);
+  EXPECT_NSEQ(l10n_util::GetNSStringWithFixup(IDS_LOGIN_DIALOG_TITLE),
+              request().title);
+  EXPECT_NSEQ(nsurlprotectionspace_util::MessageForHTTPAuth(protection_space()),
+              request().message);
+  EXPECT_NSEQ(credential().user, request().defaultUserNameText);
+}
+
+// Tests that the request executes the callback as expected.
+TEST_F(HTTPAuthDialogRequestTest, Callback) {
+  NSString* const kUsername = @"username";
+  NSString* const kPassword = @"password";
+  [request() completeAuthenticationWithUsername:kUsername password:kPassword];
+  EXPECT_NSEQ(kUsername, callback_username());
+  EXPECT_NSEQ(kPassword, callback_password());
+}

diff --git a/ios/clean/chrome/browser/ui/overlays/test_helpers/BUILD.gn b/ios/clean/chrome/browser/ui/overlays/test_helpers/BUILD.gn
index a7bf81a..d41e748 100644
--- a/ios/clean/chrome/browser/ui/overlays/test_helpers/BUILD.gn
+++ b/ios/clean/chrome/browser/ui/overlays/test_helpers/BUILD.gn

@@ -5,6 +5,8 @@
 source_set("test_helpers") {
   testonly = true
   sources = [
+    "overlay_coordinator_test.h",
+    "overlay_coordinator_test.mm",
     "test_overlay_coordinator.h",
     "test_overlay_coordinator.mm",
     "test_overlay_parent_coordinator.h",
@@ -23,6 +25,7 @@
     "//ios/chrome/browser/ui/browser_list",
     "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/coordinators",
+    "//ios/chrome/browser/ui/coordinators:test_support",
     "//ios/chrome/browser/web_state_list",
     "//ios/clean/chrome/browser/ui/commands",
     "//ios/clean/chrome/browser/ui/overlays",

diff --git a/ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.h b/ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.h
new file mode 100644
index 0000000..454a884
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.h

@@ -0,0 +1,31 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CLEAN_CHROME_BROWSER_UI_OVERLAYS_TEST_HELPERS_OVERLAY_COORDINATOR_TEST_H_
+#define IOS_CLEAN_CHROME_BROWSER_UI_OVERLAYS_TEST_HELPERS_OVERLAY_COORDINATOR_TEST_H_
+
+#import "ios/chrome/browser/ui/coordinators/browser_coordinator_test.h"
+#import "ios/clean/chrome/browser/ui/overlays/test_helpers/test_overlay_queue.h"
+
+@class OverlayCoordinator;
+
+// A test fixture for OverlayCoordinators.
+class OverlayCoordinatorTest : public BrowserCoordinatorTest {
+ public:
+  OverlayCoordinatorTest();
+  ~OverlayCoordinatorTest() override;
+
+  // Starts the OverlayCoordinator supplied by GetOverlay().
+  void StartOverlay();
+
+ protected:
+  // Returns the OverlayCoordinator being tested by this fixture.
+  virtual OverlayCoordinator* GetOverlay() = 0;
+
+ private:
+  // The queue to handle displying the overlay.
+  TestOverlayQueue queue_;
+};
+
+#endif  // IOS_CLEAN_CHROME_BROWSER_UI_OVERLAYS_TEST_HELPERS_OVERLAY_COORDINATOR_TEST_H_

diff --git a/ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.mm b/ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.mm
new file mode 100644
index 0000000..a4fe649
--- /dev/null
+++ b/ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.mm

@@ -0,0 +1,22 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/clean/chrome/browser/ui/overlays/test_helpers/overlay_coordinator_test.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+OverlayCoordinatorTest::OverlayCoordinatorTest() {
+  queue_.SetBrowser(GetBrowser());
+}
+
+OverlayCoordinatorTest::~OverlayCoordinatorTest() {
+  queue_.CancelOverlays();
+}
+
+void OverlayCoordinatorTest::StartOverlay() {
+  queue_.AddOverlay(GetOverlay());
+  queue_.StartNextOverlay();
+}

diff --git a/ios/clean/chrome/browser/ui/web_contents/BUILD.gn b/ios/clean/chrome/browser/ui/web_contents/BUILD.gn
index 4f8954f4..76cc38b 100644
--- a/ios/clean/chrome/browser/ui/web_contents/BUILD.gn
+++ b/ios/clean/chrome/browser/ui/web_contents/BUILD.gn

@@ -20,6 +20,7 @@
     "//ios/chrome/browser/ui/coordinators",
     "//ios/clean/chrome/browser/ui/commands",
     "//ios/clean/chrome/browser/ui/dialogs/context_menu",
+    "//ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs",
     "//ios/clean/chrome/browser/ui/dialogs/java_script_dialogs",
     "//ios/clean/chrome/browser/ui/overlays",
     "//ios/web",

diff --git a/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm b/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm
index 8b9077d..e5b71197 100644
--- a/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm
+++ b/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm

@@ -12,6 +12,8 @@
 #import "ios/clean/chrome/browser/ui/commands/context_menu_commands.h"
 #import "ios/clean/chrome/browser/ui/dialogs/context_menu/context_menu_dialog_coordinator.h"
 #import "ios/clean/chrome/browser/ui/dialogs/context_menu/context_menu_dialog_request.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_coordinator.h"
+#import "ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs/http_auth_dialog_request.h"
 #import "ios/clean/chrome/browser/ui/dialogs/java_script_dialogs/java_script_dialog_overlay_presenter.h"
 #import "ios/clean/chrome/browser/ui/overlays/overlay_service.h"
 #import "ios/clean/chrome/browser/ui/overlays/overlay_service_factory.h"
@@ -135,6 +137,28 @@
       ->ShowOverlayForWebState(contextMenu, self.webState);
 }
 
+- (void)webState:(web::WebState*)webState
+    didRequestHTTPAuthForProtectionSpace:(NSURLProtectionSpace*)protectionSpace
+                      proposedCredential:(NSURLCredential*)proposedCredential
+                       completionHandler:(void (^)(NSString* username,
+                                                   NSString* password))handler {
+  HTTPAuthDialogRequest* request =
+      [HTTPAuthDialogRequest requestWithWebState:webState
+                                 protectionSpace:protectionSpace
+                                      credential:proposedCredential
+                                        callback:handler];
+  HTTPAuthDialogCoordinator* dialogCoordinator =
+      [[HTTPAuthDialogCoordinator alloc] initWithRequest:request];
+  OverlayService* overlayService =
+      OverlayServiceFactory::GetInstance()->GetForBrowserState(
+          self.browser->browser_state());
+  if (overlayService) {
+    overlayService->ShowOverlayForWebState(dialogCoordinator, webState);
+  } else {
+    [dialogCoordinator cancelOverlay];
+  }
+}
+
 #pragma mark -
 
 - (void)setWebStateOverlayParent {

diff --git a/ios/clean/chrome/test/BUILD.gn b/ios/clean/chrome/test/BUILD.gn
index f188af66..b65c425 100644
--- a/ios/clean/chrome/test/BUILD.gn
+++ b/ios/clean/chrome/test/BUILD.gn

@@ -25,6 +25,7 @@
     "//ios/clean/chrome/browser/ui/bookmarks:unit_tests",
     "//ios/clean/chrome/browser/ui/dialogs:unit_tests",
     "//ios/clean/chrome/browser/ui/dialogs/context_menu:unit_tests",
+    "//ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs:unit_tests",
     "//ios/clean/chrome/browser/ui/dialogs/java_script_dialogs:unit_tests",
     "//ios/clean/chrome/browser/ui/find_in_page:unit_tests",
     "//ios/clean/chrome/browser/ui/history_popup:unit_tests",

diff --git a/ios/web/navigation/navigation_manager_impl_unittest.mm b/ios/web/navigation/navigation_manager_impl_unittest.mm
index e425f4c..7837fa8 100644
--- a/ios/web/navigation/navigation_manager_impl_unittest.mm
+++ b/ios/web/navigation/navigation_manager_impl_unittest.mm

@@ -148,7 +148,7 @@
     if (GetParam() == TEST_LEGACY_NAVIGATION_MANAGER) {
       [session_controller() goToItemAtIndex:index discardNonCommittedItems:NO];
     } else {
-      ASSERT_TRUE(false) << "Not yet implemented.";
+      [mock_wk_list_ moveCurrentToIndex:index];
     }
   }
 
@@ -321,20 +321,15 @@
   EXPECT_TRUE(navigation_manager()->CanGoBack());
   EXPECT_TRUE(navigation_manager()->CanGoToOffset(-1));
 
-  if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
-    return;
-  }
-  navigation_manager()->GoToIndex(1);
+  SimulateGoToIndex(1);
   EXPECT_TRUE(navigation_manager()->CanGoBack());
   EXPECT_TRUE(navigation_manager()->CanGoToOffset(-1));
 
-  navigation_manager()->GoToIndex(0);
+  SimulateGoToIndex(0);
   EXPECT_FALSE(navigation_manager()->CanGoBack());
   EXPECT_FALSE(navigation_manager()->CanGoToOffset(-1));
 
-  navigation_manager()->GoToIndex(1);
+  SimulateGoToIndex(1);
   EXPECT_TRUE(navigation_manager()->CanGoBack());
   EXPECT_TRUE(navigation_manager()->CanGoToOffset(-1));
 }
@@ -394,24 +389,19 @@
   EXPECT_FALSE(navigation_manager()->CanGoForward());
   EXPECT_FALSE(navigation_manager()->CanGoToOffset(1));
 
-  if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
-    return;
-  }
-  navigation_manager()->GoToIndex(1);
+  SimulateGoToIndex(1);
   EXPECT_TRUE(navigation_manager()->CanGoForward());
   EXPECT_TRUE(navigation_manager()->CanGoToOffset(1));
 
-  navigation_manager()->GoToIndex(0);
+  SimulateGoToIndex(0);
   EXPECT_TRUE(navigation_manager()->CanGoForward());
   EXPECT_TRUE(navigation_manager()->CanGoToOffset(1));
 
-  navigation_manager()->GoToIndex(1);
+  SimulateGoToIndex(1);
   EXPECT_TRUE(navigation_manager()->CanGoForward());
   EXPECT_TRUE(navigation_manager()->CanGoToOffset(1));
 
-  navigation_manager()->GoToIndex(2);
+  SimulateGoToIndex(2);
   EXPECT_FALSE(navigation_manager()->CanGoForward());
   EXPECT_FALSE(navigation_manager()->CanGoToOffset(1));
 }
@@ -482,10 +472,12 @@
   ASSERT_EQ(4, navigation_manager()->GetLastCommittedItemIndex());
 
   if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
+    // WKBasedNavigationManagerImpl doesn't treat redirect specially because it
+    // relies on WKWebView to handle that. See WKBasedNavigationManagerTest for
+    // an similar test case of the CanGoToOffset API without redirects.
     return;
   }
+
   // Go to entry at index 1 and test API from that state.
   SimulateGoToIndex(1);
   ASSERT_EQ(1, navigation_manager()->GetLastCommittedItemIndex());
@@ -687,7 +679,7 @@
   EXPECT_EQ(1000000004, navigation_manager()->GetIndexForOffset(1000000000));
 }
 
-// Tests offsets with pending transient entries (specifically gong back and
+// Tests offsets with pending transient entries (specifically going back and
 // forward from a pending navigation entry that is added to the middle of the
 // navigation stack).
 TEST_P(NavigationManagerTest, OffsetsWithPendingTransientEntry) {
@@ -756,8 +748,8 @@
   EXPECT_EQ(0, navigation_manager()->GetIndexForOffset(-1));
 
   if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
+    // TODO(crbug.com/734150): Investigate why this test still fails for the new
+    // navigation manager.
     return;
   }
 
@@ -767,9 +759,9 @@
   if (GetParam() == TEST_LEGACY_NAVIGATION_MANAGER) {
     [session_controller() setPendingItemIndex:1];
   }
-  ASSERT_EQ(3, navigation_manager()->GetItemCount());
-  ASSERT_EQ(0, navigation_manager()->GetLastCommittedItemIndex());
-  ASSERT_EQ(1, navigation_manager()->GetPendingItemIndex());
+  EXPECT_EQ(3, navigation_manager()->GetItemCount());
+  EXPECT_EQ(0, navigation_manager()->GetLastCommittedItemIndex());
+  EXPECT_EQ(1, navigation_manager()->GetPendingItemIndex());
   EXPECT_EQ(2, navigation_manager()->GetIndexForOffset(1));
   EXPECT_EQ(0, navigation_manager()->GetIndexForOffset(-1));
 }
@@ -1566,12 +1558,6 @@
       forwardListURLs:nil];
   navigation_manager()->CommitPendingItem();
 
-  if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
-    return;
-  }
-
   SimulateGoToIndex(1);
   EXPECT_EQ(1, navigation_manager()->GetLastCommittedItemIndex());
 
@@ -1718,12 +1704,6 @@
                forwardListURLs:nil];
   navigation_manager()->CommitPendingItem();
 
-  if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
-    return;
-  }
-
   SimulateGoToIndex(1);
   EXPECT_EQ(1, navigation_manager()->GetLastCommittedItemIndex());
 
@@ -1883,12 +1863,6 @@
   EXPECT_EQ("http://www.url.com/0", back_items[1]->GetURL().spec());
   EXPECT_TRUE(navigation_manager()->GetForwardItems().empty());
 
-  if (GetParam() == TEST_WK_BASED_NAVIGATION_MANAGER) {
-    // TODO(crbug.com/734150): Enable this test once |GoToIndex| is
-    // implemented in WKBasedNavigationManager.
-    return;
-  }
-
   SimulateGoToIndex(1);
   EXPECT_EQ(1, navigation_manager()->GetLastCommittedItemIndex());
   back_items = navigation_manager()->GetBackwardItems();

diff --git a/ios/web/navigation/wk_based_navigation_manager_impl.mm b/ios/web/navigation/wk_based_navigation_manager_impl.mm
index 17689717..65c23390 100644
--- a/ios/web/navigation/wk_based_navigation_manager_impl.mm
+++ b/ios/web/navigation/wk_based_navigation_manager_impl.mm

@@ -183,9 +183,6 @@
     offset++;
   }
   result += offset;
-  if (result > GetItemCount() /* overflow */) {
-    result = INT_MIN;
-  }
   return result;
 }
 

diff --git a/ios/web/navigation/wk_based_navigation_manager_impl_unittest.mm b/ios/web/navigation/wk_based_navigation_manager_impl_unittest.mm
index 36bb712..55ab3282 100644
--- a/ios/web/navigation/wk_based_navigation_manager_impl_unittest.mm
+++ b/ios/web/navigation/wk_based_navigation_manager_impl_unittest.mm

@@ -354,4 +354,114 @@
   EXPECT_EQ(nullptr, manager_->GetTransientItem());
 }
 
+// Tests CanGoToOffset API for positive, negative and zero delta.
+TEST_F(WKBasedNavigationManagerTest, CanGoToOffset) {
+  manager_->AddPendingItem(
+      GURL("http://www.url.com/0"), Referrer(), ui::PAGE_TRANSITION_LINK,
+      web::NavigationInitiationType::USER_INITIATED,
+      web::NavigationManager::UserAgentOverrideOption::INHERIT);
+
+  [mock_wk_list_ setCurrentURL:@"http://www.url.com/0"];
+  manager_->CommitPendingItem();
+
+  manager_->AddPendingItem(
+      GURL("http://www.url.com/1"), Referrer(), ui::PAGE_TRANSITION_LINK,
+      web::NavigationInitiationType::USER_INITIATED,
+      web::NavigationManager::UserAgentOverrideOption::INHERIT);
+
+  [mock_wk_list_ setCurrentURL:@"http://www.url.com/1"
+                  backListURLs:@[ @"http://www.url.com/0" ]
+               forwardListURLs:nil];
+  manager_->CommitPendingItem();
+
+  manager_->AddPendingItem(
+      GURL("http://www.url.com/2"), Referrer(), ui::PAGE_TRANSITION_LINK,
+      web::NavigationInitiationType::USER_INITIATED,
+      web::NavigationManager::UserAgentOverrideOption::INHERIT);
+
+  [mock_wk_list_
+        setCurrentURL:@"http://www.url.com/2"
+         backListURLs:@[ @"http://www.url.com/0", @"http://www.url.com/1" ]
+      forwardListURLs:nil];
+  manager_->CommitPendingItem();
+
+  ASSERT_EQ(3, manager_->GetItemCount());
+  ASSERT_EQ(2, manager_->GetLastCommittedItemIndex());
+
+  // Go to entry at index 1 and test API from that state.
+  [mock_wk_list_ moveCurrentToIndex:1];
+  ASSERT_EQ(1, manager_->GetLastCommittedItemIndex());
+  ASSERT_EQ(-1, manager_->GetPendingItemIndex());
+  EXPECT_TRUE(manager_->CanGoToOffset(-1));
+  EXPECT_EQ(0, manager_->GetIndexForOffset(-1));
+  EXPECT_FALSE(manager_->CanGoToOffset(-2));
+  EXPECT_TRUE(manager_->CanGoToOffset(1));
+  EXPECT_EQ(2, manager_->GetIndexForOffset(1));
+  EXPECT_FALSE(manager_->CanGoToOffset(2));
+  // Test with large values
+  EXPECT_FALSE(manager_->CanGoToOffset(INT_MAX));
+  EXPECT_FALSE(manager_->CanGoToOffset(INT_MIN));
+
+  // Go to entry at index 0 and test API from that state.
+  [mock_wk_list_ moveCurrentToIndex:0];
+  ASSERT_EQ(0, manager_->GetLastCommittedItemIndex());
+  ASSERT_EQ(-1, manager_->GetPendingItemIndex());
+  EXPECT_FALSE(manager_->CanGoToOffset(-1));
+  EXPECT_TRUE(manager_->CanGoToOffset(1));
+  EXPECT_EQ(1, manager_->GetIndexForOffset(1));
+  EXPECT_TRUE(manager_->CanGoToOffset(2));
+  EXPECT_EQ(2, manager_->GetIndexForOffset(2));
+  EXPECT_FALSE(manager_->CanGoToOffset(3));
+  // Test with large values
+  EXPECT_FALSE(manager_->CanGoToOffset(INT_MAX));
+  EXPECT_FALSE(manager_->CanGoToOffset(INT_MIN));
+
+  // Go to entry at index 2 and test API from that state.
+  [mock_wk_list_ moveCurrentToIndex:2];
+  ASSERT_EQ(2, manager_->GetLastCommittedItemIndex());
+  ASSERT_EQ(-1, manager_->GetPendingItemIndex());
+  EXPECT_TRUE(manager_->CanGoToOffset(-1));
+  EXPECT_EQ(1, manager_->GetIndexForOffset(-1));
+  EXPECT_TRUE(manager_->CanGoToOffset(-2));
+  EXPECT_EQ(0, manager_->GetIndexForOffset(-2));
+  EXPECT_FALSE(manager_->CanGoToOffset(1));
+  // Test with large values
+  EXPECT_FALSE(manager_->CanGoToOffset(INT_MAX));
+  EXPECT_FALSE(manager_->CanGoToOffset(INT_MIN));
+
+  // Test with transient entry.
+  manager_->AddPendingItem(
+      GURL("http://www.url.com/3"), Referrer(), ui::PAGE_TRANSITION_LINK,
+      web::NavigationInitiationType::USER_INITIATED,
+      web::NavigationManager::UserAgentOverrideOption::INHERIT);
+  manager_->AddTransientItem(GURL("http://www.url.com/3"));
+  ASSERT_EQ(3, manager_->GetItemCount());
+  ASSERT_EQ(2, manager_->GetLastCommittedItemIndex());
+  EXPECT_TRUE(manager_->CanGoToOffset(-1));
+  EXPECT_EQ(2, manager_->GetIndexForOffset(-1));
+  EXPECT_TRUE(manager_->CanGoToOffset(-3));
+  EXPECT_EQ(0, manager_->GetIndexForOffset(-3));
+  EXPECT_FALSE(manager_->CanGoToOffset(-4));
+  EXPECT_FALSE(manager_->CanGoToOffset(1));
+
+  // Simulate a history navigation pending item.
+  [mock_wk_list_ moveCurrentToIndex:1];
+  OCMExpect([mock_web_view_ URL])
+      .andReturn([[NSURL alloc] initWithString:@"http://www.url.com/1"]);
+  manager_->AddPendingItem(
+      GURL("http://www.url.com/1"), Referrer(), ui::PAGE_TRANSITION_LINK,
+      web::NavigationInitiationType::USER_INITIATED,
+      web::NavigationManager::UserAgentOverrideOption::INHERIT);
+
+  EXPECT_EQ(3, manager_->GetItemCount());
+  EXPECT_EQ(2, manager_->GetLastCommittedItemIndex());
+  EXPECT_EQ(1, manager_->GetPendingItemIndex());
+  EXPECT_TRUE(manager_->CanGoToOffset(-1));
+  EXPECT_EQ(0, manager_->GetIndexForOffset(-1));
+  EXPECT_FALSE(manager_->CanGoToOffset(-2));
+  EXPECT_TRUE(manager_->CanGoToOffset(1));
+  EXPECT_EQ(2, manager_->GetIndexForOffset(1));
+  EXPECT_FALSE(manager_->CanGoToOffset(2));
+}
+
 }  // namespace web

diff --git a/ios/web/public/test/fakes/crw_test_web_state_observer.mm b/ios/web/public/test/fakes/crw_test_web_state_observer.mm
index 59193fb..6547da9 100644
--- a/ios/web/public/test/fakes/crw_test_web_state_observer.mm
+++ b/ios/web/public/test/fakes/crw_test_web_state_observer.mm

@@ -152,7 +152,7 @@
   std::unique_ptr<web::NavigationContextImpl> context =
       web::NavigationContextImpl::CreateNavigationContext(
           navigation->GetWebState(), navigation->GetUrl(),
-          navigation->GetPageTransition());
+          navigation->GetPageTransition(), navigation->IsRendererInitiated());
   context->SetIsSameDocument(navigation->IsSameDocument());
   context->SetError(navigation->GetError());
   _didStartNavigationInfo->context = std::move(context);
@@ -175,7 +175,7 @@
   std::unique_ptr<web::NavigationContextImpl> context =
       web::NavigationContextImpl::CreateNavigationContext(
           navigation->GetWebState(), navigation->GetUrl(),
-          navigation->GetPageTransition());
+          navigation->GetPageTransition(), navigation->IsRendererInitiated());
   context->SetIsSameDocument(navigation->IsSameDocument());
   context->SetError(navigation->GetError());
   _didFinishNavigationInfo->context = std::move(context);

diff --git a/ios/web/public/test/fakes/fake_navigation_context.h b/ios/web/public/test/fakes/fake_navigation_context.h
index 19fbef86..7db3a1a5 100644
--- a/ios/web/public/test/fakes/fake_navigation_context.h
+++ b/ios/web/public/test/fakes/fake_navigation_context.h

@@ -29,6 +29,7 @@
   bool IsPost() const override;
   NSError* GetError() const override;
   net::HttpResponseHeaders* GetResponseHeaders() const override;
+  bool IsRendererInitiated() const override;
 
   // Setters for navigation context data members.
   void SetResponseHeaders(

diff --git a/ios/web/public/test/fakes/fake_navigation_context.mm b/ios/web/public/test/fakes/fake_navigation_context.mm
index 37a6b7bdc..217e401 100644
--- a/ios/web/public/test/fakes/fake_navigation_context.mm
+++ b/ios/web/public/test/fakes/fake_navigation_context.mm

@@ -44,6 +44,10 @@
   return response_headers_.get();
 }
 
+bool FakeNavigationContext::IsRendererInitiated() const {
+  return false;
+}
+
 void FakeNavigationContext::SetResponseHeaders(
     const scoped_refptr<net::HttpResponseHeaders>& response_headers) {
   response_headers_ = response_headers;

diff --git a/ios/web/public/test/fakes/test_web_state_observer.mm b/ios/web/public/test/fakes/test_web_state_observer.mm
index c90af93..080c0f3 100644
--- a/ios/web/public/test/fakes/test_web_state_observer.mm
+++ b/ios/web/public/test/fakes/test_web_state_observer.mm

@@ -80,7 +80,7 @@
   std::unique_ptr<web::NavigationContextImpl> context =
       web::NavigationContextImpl::CreateNavigationContext(
           navigation->GetWebState(), navigation->GetUrl(),
-          navigation->GetPageTransition());
+          navigation->GetPageTransition(), navigation->IsRendererInitiated());
   context->SetIsSameDocument(navigation->IsSameDocument());
   context->SetError(navigation->GetError());
   did_start_navigation_info_->context = std::move(context);
@@ -94,7 +94,7 @@
   std::unique_ptr<web::NavigationContextImpl> context =
       web::NavigationContextImpl::CreateNavigationContext(
           navigation->GetWebState(), navigation->GetUrl(),
-          navigation->GetPageTransition());
+          navigation->GetPageTransition(), navigation->IsRendererInitiated());
   context->SetIsSameDocument(navigation->IsSameDocument());
   context->SetError(navigation->GetError());
   did_finish_navigation_info_->context = std::move(context);

diff --git a/ios/web/public/web_state/navigation_context.h b/ios/web/public/web_state/navigation_context.h
index cbfcc19c..c8ca372 100644
--- a/ios/web/public/web_state/navigation_context.h
+++ b/ios/web/public/web_state/navigation_context.h

@@ -59,6 +59,14 @@
   // returned should not be modified, as modifications will not be reflected.
   virtual net::HttpResponseHeaders* GetResponseHeaders() const = 0;
 
+  // Whether the navigation was initiated by the renderer process. Examples of
+  // renderer-initiated navigations include:
+  //  * <a> link click
+  //  * changing window.location.href
+  //  * redirect via the <meta http-equiv="refresh"> tag
+  //  * using window.history.pushState
+  virtual bool IsRendererInitiated() const = 0;
+
   virtual ~NavigationContext() {}
 };
 

diff --git a/ios/web/test/fakes/crw_test_back_forward_list.h b/ios/web/test/fakes/crw_test_back_forward_list.h
index 3c6b7eb0..159e28b 100644
--- a/ios/web/test/fakes/crw_test_back_forward_list.h
+++ b/ios/web/test/fakes/crw_test_back_forward_list.h

@@ -35,6 +35,13 @@
 - (void)setCurrentURL:(NSString*)currentItemURL
          backListURLs:(nullable NSArray<NSString*>*)backListURLs
       forwardListURLs:(nullable NSArray<NSString*>*)forwardListURLs;
+
+// Simulates go-to-index operation on this instance. Shuffles the items in this
+// instance such that currentItem is at position |index| of the logical list
+// formed by backList + currentItem + forwardList. backList[0] has index 0.
+// |index| must be in the range [0, # of items in this instance).
+- (void)moveCurrentToIndex:(NSUInteger)index;
+
 @end
 
 NS_ASSUME_NONNULL_END

diff --git a/ios/web/test/fakes/crw_test_back_forward_list.mm b/ios/web/test/fakes/crw_test_back_forward_list.mm
index b7fcffb3..e5dc2dc 100644
--- a/ios/web/test/fakes/crw_test_back_forward_list.mm
+++ b/ios/web/test/fakes/crw_test_back_forward_list.mm

@@ -6,6 +6,7 @@
 
 #import <WebKit/WebKit.h>
 
+#include "base/logging.h"
 #include "third_party/ocmock/OCMock/OCMock.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
@@ -51,6 +52,33 @@
   self.forwardList = [self mockSublistWithURLArray:forwardListURLs];
 }
 
+- (void)moveCurrentToIndex:(NSUInteger)index {
+  NSMutableArray* logicalList = [[NSMutableArray alloc] init];
+  if (self.backList)
+    [logicalList addObjectsFromArray:self.backList];
+  if (self.currentItem)
+    [logicalList addObject:self.currentItem];
+  if (self.forwardList)
+    [logicalList addObjectsFromArray:self.forwardList];
+
+  NSUInteger count = logicalList.count;
+  CHECK(index < count);
+
+  self.currentItem = logicalList[index];
+  if (index == 0) {
+    self.backList = nil;
+  } else {
+    NSRange range = NSMakeRange(0, index);
+    self.backList = [logicalList subarrayWithRange:range];
+  }
+  if (index + 1 == count) {
+    self.forwardList = nil;
+  } else {
+    NSRange range = NSMakeRange(index + 1, count - index - 1);
+    self.forwardList = [logicalList subarrayWithRange:range];
+  }
+}
+
 - (NSArray*)mockSublistWithURLArray:(NSArray<NSString*>*)URLs {
   NSMutableArray* array = [NSMutableArray arrayWithCapacity:URLs.count];
   for (NSString* URL : URLs) {

diff --git a/ios/web/web_state/navigation_context_impl.h b/ios/web/web_state/navigation_context_impl.h
index 4e5687b4..1432e7cc 100644
--- a/ios/web/web_state/navigation_context_impl.h
+++ b/ios/web/web_state/navigation_context_impl.h

@@ -23,7 +23,8 @@
   static std::unique_ptr<NavigationContextImpl> CreateNavigationContext(
       WebState* web_state,
       const GURL& url,
-      ui::PageTransition page_transition);
+      ui::PageTransition page_transition,
+      bool is_renderer_initiated);
 
 #ifndef NDEBUG
   // Returns human readable description of this object.
@@ -38,6 +39,7 @@
   bool IsPost() const override;
   NSError* GetError() const override;
   net::HttpResponseHeaders* GetResponseHeaders() const override;
+  bool IsRendererInitiated() const override;
   ~NavigationContextImpl() override;
 
   // Setters for navigation context data members.
@@ -46,6 +48,7 @@
   void SetError(NSError* error);
   void SetResponseHeaders(
       const scoped_refptr<net::HttpResponseHeaders>& response_headers);
+  void SetIsRendererInitiated(bool is_renderer_initiated);
 
   // Optional unique id of the navigation item associated with this navigaiton.
   int GetNavigationItemUniqueID() const;
@@ -54,7 +57,8 @@
  private:
   NavigationContextImpl(WebState* web_state,
                         const GURL& url,
-                        ui::PageTransition page_transition);
+                        ui::PageTransition page_transition,
+                        bool is_renderer_initiated);
 
   WebState* web_state_ = nullptr;
   GURL url_;
@@ -63,6 +67,7 @@
   bool is_post_ = false;
   base::scoped_nsobject<NSError> error_;
   scoped_refptr<net::HttpResponseHeaders> response_headers_;
+  bool is_renderer_initiated_ = false;
   int navigation_item_unique_id_ = -1;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationContextImpl);

diff --git a/ios/web/web_state/navigation_context_impl.mm b/ios/web/web_state/navigation_context_impl.mm
index d5055e0..5cd26f7 100644
--- a/ios/web/web_state/navigation_context_impl.mm
+++ b/ios/web/web_state/navigation_context_impl.mm

@@ -20,9 +20,10 @@
 NavigationContextImpl::CreateNavigationContext(
     WebState* web_state,
     const GURL& url,
-    ui::PageTransition page_transition) {
-  std::unique_ptr<NavigationContextImpl> result(
-      new NavigationContextImpl(web_state, url, page_transition));
+    ui::PageTransition page_transition,
+    bool is_renderer_initiated) {
+  std::unique_ptr<NavigationContextImpl> result(new NavigationContextImpl(
+      web_state, url, page_transition, is_renderer_initiated));
   return result;
 }
 
@@ -64,6 +65,10 @@
   return response_headers_.get();
 }
 
+bool NavigationContextImpl::IsRendererInitiated() const {
+  return is_renderer_initiated_;
+}
+
 void NavigationContextImpl::SetIsSameDocument(bool is_same_document) {
   is_same_document_ = is_same_document;
 }
@@ -81,6 +86,10 @@
   response_headers_ = response_headers;
 }
 
+void NavigationContextImpl::SetIsRendererInitiated(bool is_renderer_initiated) {
+  is_renderer_initiated_ = is_renderer_initiated;
+}
+
 int NavigationContextImpl::GetNavigationItemUniqueID() const {
   return navigation_item_unique_id_;
 }
@@ -91,13 +100,15 @@
 
 NavigationContextImpl::NavigationContextImpl(WebState* web_state,
                                              const GURL& url,
-                                             ui::PageTransition page_transition)
+                                             ui::PageTransition page_transition,
+                                             bool is_renderer_initiated)
     : web_state_(web_state),
       url_(url),
       page_transition_(page_transition),
       is_same_document_(false),
       error_(nil),
-      response_headers_(nullptr) {}
+      response_headers_(nullptr),
+      is_renderer_initiated_(is_renderer_initiated) {}
 
 NavigationContextImpl::~NavigationContextImpl() = default;
 

diff --git a/ios/web/web_state/navigation_context_impl_unittest.mm b/ios/web/web_state/navigation_context_impl_unittest.mm
index 533524d4..4688e4c 100644
--- a/ios/web/web_state/navigation_context_impl_unittest.mm
+++ b/ios/web/web_state/navigation_context_impl_unittest.mm

@@ -38,7 +38,8 @@
 TEST_F(NavigationContextImplTest, NavigationContext) {
   std::unique_ptr<NavigationContext> context =
       NavigationContextImpl::CreateNavigationContext(
-          &web_state_, url_, ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK);
+          &web_state_, url_, ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK,
+          true);
   ASSERT_TRUE(context);
 
   EXPECT_EQ(&web_state_, context->GetWebState());
@@ -49,18 +50,21 @@
   EXPECT_FALSE(context->IsSameDocument());
   EXPECT_FALSE(context->GetError());
   EXPECT_FALSE(context->GetResponseHeaders());
+  EXPECT_TRUE(context->IsRendererInitiated());
 }
 
 // Tests NavigationContextImpl Setters.
 TEST_F(NavigationContextImplTest, Setters) {
   std::unique_ptr<NavigationContextImpl> context =
       NavigationContextImpl::CreateNavigationContext(
-          &web_state_, url_, ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK);
+          &web_state_, url_, ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK,
+          false);
   ASSERT_TRUE(context);
 
   ASSERT_FALSE(context->IsSameDocument());
   ASSERT_FALSE(context->IsPost());
   ASSERT_FALSE(context->GetError());
+  ASSERT_FALSE(context->IsRendererInitiated());
   ASSERT_NE(response_headers_.get(), context->GetResponseHeaders());
 
   // SetSameDocument
@@ -68,6 +72,7 @@
   EXPECT_TRUE(context->IsSameDocument());
   ASSERT_FALSE(context->IsPost());
   EXPECT_FALSE(context->GetError());
+  EXPECT_FALSE(context->IsRendererInitiated());
   EXPECT_NE(response_headers_.get(), context->GetResponseHeaders());
 
   // SetPost
@@ -75,6 +80,7 @@
   EXPECT_TRUE(context->IsSameDocument());
   ASSERT_TRUE(context->IsPost());
   EXPECT_FALSE(context->GetError());
+  EXPECT_FALSE(context->IsRendererInitiated());
   EXPECT_NE(response_headers_.get(), context->GetResponseHeaders());
 
   // SetErrorPage
@@ -83,6 +89,7 @@
   EXPECT_TRUE(context->IsSameDocument());
   ASSERT_TRUE(context->IsPost());
   EXPECT_EQ(error, context->GetError());
+  EXPECT_FALSE(context->IsRendererInitiated());
   EXPECT_NE(response_headers_.get(), context->GetResponseHeaders());
 
   // SetResponseHeaders
@@ -90,6 +97,15 @@
   EXPECT_TRUE(context->IsSameDocument());
   ASSERT_TRUE(context->IsPost());
   EXPECT_EQ(error, context->GetError());
+  EXPECT_FALSE(context->IsRendererInitiated());
+  EXPECT_EQ(response_headers_.get(), context->GetResponseHeaders());
+
+  // SetIsRendererInitiated
+  context->SetIsRendererInitiated(true);
+  EXPECT_TRUE(context->IsSameDocument());
+  ASSERT_TRUE(context->IsPost());
+  EXPECT_EQ(error, context->GetError());
+  EXPECT_TRUE(context->IsRendererInitiated());
   EXPECT_EQ(response_headers_.get(), context->GetResponseHeaders());
 }
 

diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 17c70f9..a8103ac 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm

@@ -1279,8 +1279,8 @@
                  stateObject:(NSString*)stateObject
                   transition:(ui::PageTransition)transition {
   std::unique_ptr<web::NavigationContextImpl> context =
-      web::NavigationContextImpl::CreateNavigationContext(_webStateImpl,
-                                                          pageURL, transition);
+      web::NavigationContextImpl::CreateNavigationContext(
+          _webStateImpl, pageURL, transition, true);
   context->SetIsSameDocument(true);
   _webStateImpl->OnNavigationStarted(context.get());
   [[self sessionController] pushNewItemWithURL:pageURL
@@ -1295,7 +1295,7 @@
   std::unique_ptr<web::NavigationContextImpl> context =
       web::NavigationContextImpl::CreateNavigationContext(
           _webStateImpl, pageURL,
-          ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT);
+          ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT, true);
   context->SetIsSameDocument(true);
   _webStateImpl->OnNavigationStarted(context.get());
   [[self sessionController] updateCurrentItemWithURL:pageURL
@@ -1438,10 +1438,16 @@
 
   [_delegate webWillAddPendingURL:requestURL transition:transition];
   // Add or update pending url.
-  if (self.navigationManagerImpl->GetPendingItem()) {
+  bool isRendererInitiated = true;
+  web::NavigationItem* pendingItem =
+      self.navigationManagerImpl->GetPendingItem();
+  if (pendingItem) {
     // Update the existing pending entry.
     // Typically on PAGE_TRANSITION_CLIENT_REDIRECT.
     self.navigationManagerImpl->UpdatePendingItemUrl(requestURL);
+    isRendererInitiated = static_cast<web::NavigationItemImpl*>(pendingItem)
+                              ->NavigationInitiationType() ==
+                          web::NavigationInitiationType::RENDERER_INITIATED;
   } else {
     // A new session history entry needs to be created.
     self.navigationManagerImpl->AddPendingItem(
@@ -1451,7 +1457,7 @@
   }
   std::unique_ptr<web::NavigationContextImpl> context =
       web::NavigationContextImpl::CreateNavigationContext(
-          _webStateImpl, requestURL, transition);
+          _webStateImpl, requestURL, transition, isRendererInitiated);
 
   web::NavigationItem* item = self.navigationManagerImpl->GetPendingItem();
   // TODO(crbug.com/676129): AddPendingItem does not always create a pending
@@ -4018,7 +4024,7 @@
     // should not be treated as a navigation, but WKNavigationDelegate callbacks
     // still expect a valid context.
     context = web::NavigationContextImpl::CreateNavigationContext(
-        _webStateImpl, URL, loadHTMLTransition);
+        _webStateImpl, URL, loadHTMLTransition, false);
   } else {
     context = [self registerLoadRequestForURL:URL
                                      referrer:web::Referrer()

diff --git a/ios/web/web_state/ui/crw_wk_navigation_states_unittest.mm b/ios/web/web_state/ui/crw_wk_navigation_states_unittest.mm
index 9266aa9..db6b3ee 100644
--- a/ios/web/web_state/ui/crw_wk_navigation_states_unittest.mm
+++ b/ios/web/web_state/ui/crw_wk_navigation_states_unittest.mm

@@ -85,7 +85,7 @@
   std::unique_ptr<web::NavigationContextImpl> context =
       NavigationContextImpl::CreateNavigationContext(
           nullptr /*web_state*/, GURL(kTestUrl1),
-          ui::PageTransition::PAGE_TRANSITION_SERVER_REDIRECT);
+          ui::PageTransition::PAGE_TRANSITION_SERVER_REDIRECT, true);
   [states_ setContext:std::move(context) forNavigation:navigation3_];
   EXPECT_EQ(navigation3_, [states_ lastAddedNavigation]);
   EXPECT_EQ(WKNavigationState::NONE, [states_ lastAddedNavigationState]);
@@ -101,7 +101,7 @@
   std::unique_ptr<web::NavigationContextImpl> context1 =
       NavigationContextImpl::CreateNavigationContext(
           nullptr /*web_state*/, GURL(kTestUrl1),
-          ui::PageTransition::PAGE_TRANSITION_RELOAD);
+          ui::PageTransition::PAGE_TRANSITION_RELOAD, false);
   context1->SetIsSameDocument(true);
   [states_ setContext:std::move(context1) forNavigation:navigation1_];
   EXPECT_FALSE([states_ contextForNavigation:navigation2_]);
@@ -111,12 +111,14 @@
             [states_ contextForNavigation:navigation1_]->GetUrl());
   EXPECT_TRUE([states_ contextForNavigation:navigation1_]->IsSameDocument());
   EXPECT_FALSE([states_ contextForNavigation:navigation1_]->GetError());
+  EXPECT_FALSE(
+      [states_ contextForNavigation:navigation1_]->IsRendererInitiated());
 
   // Replace existing context.
   std::unique_ptr<web::NavigationContextImpl> context2 =
       NavigationContextImpl::CreateNavigationContext(
           nullptr /*web_state*/, GURL(kTestUrl2),
-          ui::PageTransition::PAGE_TRANSITION_GENERATED);
+          ui::PageTransition::PAGE_TRANSITION_GENERATED, true);
   NSError* error = [[NSError alloc] init];
   context2->SetError(error);
   [states_ setContext:std::move(context2) forNavigation:navigation1_];
@@ -127,6 +129,8 @@
             [states_ contextForNavigation:navigation1_]->GetUrl());
   EXPECT_FALSE([states_ contextForNavigation:navigation1_]->IsSameDocument());
   EXPECT_EQ(error, [states_ contextForNavigation:navigation1_]->GetError());
+  EXPECT_TRUE(
+      [states_ contextForNavigation:navigation1_]->IsRendererInitiated());
 }
 
 // Tests null WKNavigation object.

diff --git a/ios/web/web_state/web_state_impl_unittest.mm b/ios/web/web_state/web_state_impl_unittest.mm
index 53c35a1..3f9a60b 100644
--- a/ios/web/web_state/web_state_impl_unittest.mm
+++ b/ios/web/web_state/web_state_impl_unittest.mm

@@ -364,7 +364,7 @@
   std::unique_ptr<web::NavigationContext> context =
       NavigationContextImpl::CreateNavigationContext(
           web_state_.get(), url,
-          ui::PageTransition::PAGE_TRANSITION_AUTO_BOOKMARK);
+          ui::PageTransition::PAGE_TRANSITION_AUTO_BOOKMARK, true);
   web_state_->OnNavigationFinished(context.get());
   ASSERT_TRUE(observer->did_finish_navigation_info());
   EXPECT_EQ(web_state_.get(),

diff --git a/ios/web/web_state/web_state_observer_bridge_unittest.mm b/ios/web/web_state/web_state_observer_bridge_unittest.mm
index 03427475..e2451b0 100644
--- a/ios/web/web_state/web_state_observer_bridge_unittest.mm
+++ b/ios/web/web_state/web_state_observer_bridge_unittest.mm

@@ -60,7 +60,7 @@
   std::unique_ptr<web::NavigationContext> context =
       web::NavigationContextImpl::CreateNavigationContext(
           &test_web_state_, url,
-          ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK);
+          ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK, false);
   bridge_->DidStartNavigation(context.get());
 
   ASSERT_TRUE([observer_ didStartNavigationInfo]);
@@ -87,7 +87,7 @@
   std::unique_ptr<web::NavigationContext> context =
       web::NavigationContextImpl::CreateNavigationContext(
           &test_web_state_, url,
-          ui::PageTransition::PAGE_TRANSITION_FROM_ADDRESS_BAR);
+          ui::PageTransition::PAGE_TRANSITION_FROM_ADDRESS_BAR, false);
   bridge_->DidFinishNavigation(context.get());
 
   ASSERT_TRUE([observer_ didFinishNavigationInfo]);

diff --git a/ios/web/webui/crw_web_ui_manager_unittest.mm b/ios/web/webui/crw_web_ui_manager_unittest.mm
index 3fd0588..99bfa65 100644
--- a/ios/web/webui/crw_web_ui_manager_unittest.mm
+++ b/ios/web/webui/crw_web_ui_manager_unittest.mm

@@ -144,7 +144,7 @@
   std::unique_ptr<web::NavigationContext> context =
       NavigationContextImpl::CreateNavigationContext(
           web_state_impl_.get(), url,
-          ui::PageTransition::PAGE_TRANSITION_AUTO_BOOKMARK);
+          ui::PageTransition::PAGE_TRANSITION_AUTO_BOOKMARK, true);
   web_state_impl_->OnNavigationStarted(context.get());
 }
 

diff --git a/media/audio/audio_device_thread.cc b/media/audio/audio_device_thread.cc
index f0aa11c..cbbdffb 100644
--- a/media/audio/audio_device_thread.cc
+++ b/media/audio/audio_device_thread.cc

@@ -31,17 +31,18 @@
 
 AudioDeviceThread::Callback::Callback(const AudioParameters& audio_parameters,
                                       base::SharedMemoryHandle memory,
-                                      int memory_length,
-                                      int total_segments)
+                                      uint32_t segment_length,
+                                      uint32_t total_segments)
     : audio_parameters_(audio_parameters),
-      shared_memory_(memory, false),
-      memory_length_(memory_length),
+      memory_length_(
+          base::CheckMul(segment_length, total_segments).ValueOrDie()),
       total_segments_(total_segments),
-      // Avoid division by zero during construction.
-      segment_length_(memory_length_ /
-                      (total_segments_ ? total_segments_ : 1)) {
-  CHECK_GT(total_segments_, 0);
-  CHECK_EQ(memory_length_ % total_segments_, 0);
+      segment_length_(segment_length),
+      // CHECK that the shared memory is large enough. The memory allocated
+      // must be at least as large as expected.
+      shared_memory_((CHECK(memory_length_ <= memory.GetSize()), memory),
+                     false) {
+  CHECK_GT(total_segments_, 0u);
   thread_checker_.DetachFromThread();
 }
 

diff --git a/media/audio/audio_device_thread.h b/media/audio/audio_device_thread.h
index f3287ef..6e1f22d 100644
--- a/media/audio/audio_device_thread.h
+++ b/media/audio/audio_device_thread.h

@@ -31,8 +31,8 @@
    public:
     Callback(const AudioParameters& audio_parameters,
              base::SharedMemoryHandle memory,
-             int memory_length,
-             int total_segments);
+             uint32_t segment_length,
+             uint32_t total_segments);
 
     // One time initialization for the callback object on the audio thread.
     void InitializeOnAudioThread();
@@ -52,10 +52,11 @@
     // constructor and must never change.
     const AudioParameters audio_parameters_;
 
+    const uint32_t memory_length_;
+    const uint32_t total_segments_;
+    const uint32_t segment_length_;
+
     base::SharedMemory shared_memory_;
-    const int memory_length_;
-    const int total_segments_;
-    const int segment_length_;
 
     // Detached in constructor and attached in InitializeOnAudioThread() which
     // is called on the audio device thread. Sub-classes can then use it for

diff --git a/media/audio/audio_input_device.cc b/media/audio/audio_input_device.cc
index 37365a42..a717934 100644
--- a/media/audio/audio_input_device.cc
+++ b/media/audio/audio_input_device.cc

@@ -6,9 +6,11 @@
 
 #include <stdint.h>
 #include <utility>
+#include <vector>
 
 #include "base/bind.h"
 #include "base/callback_forward.h"
+#include "base/format_macros.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
@@ -52,8 +54,7 @@
  public:
   AudioThreadCallback(const AudioParameters& audio_parameters,
                       base::SharedMemoryHandle memory,
-                      int memory_length,
-                      int total_segments,
+                      uint32_t total_segments,
                       CaptureCallback* capture_callback,
                       base::RepeatingClosure got_data_callback);
   ~AudioThreadCallback() override;
@@ -65,7 +66,7 @@
 
  private:
   const double bytes_per_ms_;
-  int current_segment_id_;
+  size_t current_segment_id_;
   uint32_t last_buffer_id_;
   std::vector<std::unique_ptr<media::AudioBus>> audio_buses_;
   CaptureCallback* capture_callback_;
@@ -151,8 +152,6 @@
 
 void AudioInputDevice::OnStreamCreated(base::SharedMemoryHandle handle,
                                        base::SyncSocket::Handle socket_handle,
-                                       int length,
-                                       int total_segments,
                                        bool initially_muted) {
   DCHECK(task_runner()->BelongsToCurrentThread());
   DCHECK(base::SharedMemory::IsHandleValid(handle));
@@ -161,7 +160,7 @@
 #else
   DCHECK_GE(socket_handle, 0);
 #endif
-  DCHECK_GT(length, 0);
+  DCHECK_GT(handle.GetSize(), 0u);
 
   if (state_ != CREATING_STREAM)
     return;
@@ -180,7 +179,7 @@
     callback_->OnCaptureMuted(true);
 
   audio_callback_.reset(new AudioInputDevice::AudioThreadCallback(
-      audio_parameters_, handle, length, total_segments, callback_,
+      audio_parameters_, handle, kRequestedSharedMemoryCount, callback_,
       base::BindRepeating(&AudioInputDevice::SetLastCallbackTimeToNow, this)));
   audio_thread_.reset(new AudioDeviceThread(audio_callback_.get(),
                                             socket_handle, "AudioInputDevice"));
@@ -354,17 +353,17 @@
 AudioInputDevice::AudioThreadCallback::AudioThreadCallback(
     const AudioParameters& audio_parameters,
     base::SharedMemoryHandle memory,
-    int memory_length,
-    int total_segments,
+    uint32_t total_segments,
     CaptureCallback* capture_callback,
     base::RepeatingClosure got_data_callback_)
-    : AudioDeviceThread::Callback(audio_parameters,
-                                  memory,
-                                  memory_length,
-                                  total_segments),
+    : AudioDeviceThread::Callback(
+          audio_parameters,
+          memory,
+          ComputeAudioInputBufferSize(audio_parameters, 1u),
+          total_segments),
       bytes_per_ms_(static_cast<double>(audio_parameters.GetBytesPerSecond()) /
                     base::Time::kMillisecondsPerSecond),
-      current_segment_id_(0),
+      current_segment_id_(0u),
       last_buffer_id_(UINT32_MAX),
       capture_callback_(capture_callback),
       got_data_callback_interval_in_frames_(kGotDataCallbackIntervalSeconds *
@@ -380,7 +379,7 @@
 
   // Create vector of audio buses by wrapping existing blocks of memory.
   uint8_t* ptr = static_cast<uint8_t*>(shared_memory_.memory());
-  for (int i = 0; i < total_segments_; ++i) {
+  for (uint32_t i = 0; i < total_segments_; ++i) {
     media::AudioInputBuffer* buffer =
         reinterpret_cast<media::AudioInputBuffer*>(ptr);
     audio_buses_.push_back(
@@ -416,9 +415,9 @@
     LOG(ERROR) << message;
     capture_callback_->OnCaptureError(message);
   }
-  if (current_segment_id_ != static_cast<int>(pending_data)) {
+  if (current_segment_id_ != pending_data) {
     std::string message = base::StringPrintf(
-        "Segment id not matching. Remote = %u. Local = %d.",
+        "Segment id not matching. Remote = %u. Local = %" PRIuS ".",
         pending_data, current_segment_id_);
     LOG(ERROR) << message;
     capture_callback_->OnCaptureError(message);
@@ -449,7 +448,7 @@
       buffer->params.volume, buffer->params.key_pressed);
 
   if (++current_segment_id_ >= total_segments_)
-    current_segment_id_ = 0;
+    current_segment_id_ = 0u;
 }
 
 }  // namespace media

diff --git a/media/audio/audio_input_device.h b/media/audio/audio_input_device.h
index baee663..69125f5 100644
--- a/media/audio/audio_input_device.h
+++ b/media/audio/audio_input_device.h

@@ -102,8 +102,6 @@
   // AudioInputIPCDelegate implementation.
   void OnStreamCreated(base::SharedMemoryHandle handle,
                        base::SyncSocket::Handle socket_handle,
-                       int length,
-                       int total_segments,
                        bool initially_muted) override;
   void OnError() override;
   void OnMuted(bool is_muted) override;

diff --git a/media/audio/audio_input_device_unittest.cc b/media/audio/audio_input_device_unittest.cc
index 3862398..16ff0fc6 100644
--- a/media/audio/audio_input_device_unittest.cc
+++ b/media/audio/audio_input_device_unittest.cc

@@ -25,6 +25,8 @@
 
 namespace {
 
+const size_t kMemorySegmentCount = 10u;
+
 class MockAudioInputIPC : public AudioInputIPC {
  public:
   MockAudioInputIPC() {}
@@ -98,9 +100,9 @@
   base::RunLoop().RunUntilIdle();
 }
 
-ACTION_P5(ReportOnStreamCreated, device, handle, socket, length, segments) {
-  static_cast<AudioInputIPCDelegate*>(device)->OnStreamCreated(
-      handle, socket, length, segments, false);
+ACTION_P3(ReportOnStreamCreated, device, handle, socket) {
+  static_cast<AudioInputIPCDelegate*>(device)->OnStreamCreated(handle, socket,
+                                                               false);
 }
 
 TEST(AudioInputDeviceTest, CreateStream) {
@@ -110,8 +112,8 @@
   CancelableSyncSocket browser_socket;
   CancelableSyncSocket renderer_socket;
 
-  const int memory_size = sizeof(AudioInputBufferParameters) +
-                          AudioBus::CalculateMemorySize(params);
+  const uint32_t memory_size =
+      media::ComputeAudioInputBufferSize(params, kMemorySegmentCount);
 
   ASSERT_TRUE(shared_memory.CreateAndMapAnonymous(memory_size));
   memset(shared_memory.memory(), 0xff, memory_size);
@@ -136,8 +138,7 @@
   EXPECT_CALL(*input_ipc, CreateStream(_, _, _, _, _))
       .WillOnce(ReportOnStreamCreated(
           device.get(), duplicated_memory_handle,
-          SyncSocket::UnwrapHandle(audio_device_socket_descriptor), memory_size,
-          1));
+          SyncSocket::UnwrapHandle(audio_device_socket_descriptor)));
   EXPECT_CALL(*input_ipc, RecordStream());
   EXPECT_CALL(callback, OnCaptureStarted())
       .WillOnce(QuitLoop(io_loop.task_runner()));

diff --git a/media/audio/audio_input_ipc.h b/media/audio/audio_input_ipc.h
index 1f51ebe..bc3dc27 100644
--- a/media/audio/audio_input_ipc.h
+++ b/media/audio/audio_input_ipc.h

@@ -29,8 +29,6 @@
   // and process the shared memory whenever data is read from the socket.
   virtual void OnStreamCreated(base::SharedMemoryHandle handle,
                                base::SyncSocket::Handle socket_handle,
-                               int length,
-                               int total_segments,
                                bool initially_muted) = 0;
 
   // Called when state of an audio stream has changed.

diff --git a/media/audio/audio_output_device.cc b/media/audio/audio_output_device.cc
index 00cfe03..336f040 100644
--- a/media/audio/audio_output_device.cc
+++ b/media/audio/audio_output_device.cc

@@ -31,7 +31,6 @@
  public:
   AudioThreadCallback(const AudioParameters& audio_parameters,
                       base::SharedMemoryHandle memory,
-                      int memory_length,
                       AudioRendererSink::RenderCallback* render_callback);
   ~AudioThreadCallback() override;
 
@@ -385,8 +384,7 @@
 
 void AudioOutputDevice::OnStreamCreated(
     base::SharedMemoryHandle handle,
-    base::SyncSocket::Handle socket_handle,
-    int length) {
+    base::SyncSocket::Handle socket_handle) {
   DCHECK(task_runner()->BelongsToCurrentThread());
   DCHECK(base::SharedMemory::IsHandleValid(handle));
 #if defined(OS_WIN)
@@ -394,7 +392,7 @@
 #else
   DCHECK_GE(socket_handle, 0);
 #endif
-  DCHECK_GT(length, 0);
+  DCHECK_GT(handle.GetSize(), 0u);
 
   if (state_ != CREATING_STREAM)
     return;
@@ -420,7 +418,7 @@
     DCHECK(!audio_callback_);
 
     audio_callback_.reset(new AudioOutputDevice::AudioThreadCallback(
-        audio_parameters_, handle, length, callback_));
+        audio_parameters_, handle, callback_));
     audio_thread_.reset(new AudioDeviceThread(
         audio_callback_.get(), socket_handle, "AudioOutputDevice"));
     state_ = PAUSED;
@@ -451,9 +449,12 @@
 AudioOutputDevice::AudioThreadCallback::AudioThreadCallback(
     const AudioParameters& audio_parameters,
     base::SharedMemoryHandle memory,
-    int memory_length,
     AudioRendererSink::RenderCallback* render_callback)
-    : AudioDeviceThread::Callback(audio_parameters, memory, memory_length, 1),
+    : AudioDeviceThread::Callback(
+          audio_parameters,
+          memory,
+          ComputeAudioOutputBufferSize(audio_parameters),
+          1),
       render_callback_(render_callback),
       callback_num_(0) {}
 
@@ -461,11 +462,8 @@
 }
 
 void AudioOutputDevice::AudioThreadCallback::MapSharedMemory() {
-  CHECK_EQ(total_segments_, 1);
+  CHECK_EQ(total_segments_, 1u);
   CHECK(shared_memory_.Map(memory_length_));
-  DCHECK_EQ(static_cast<size_t>(memory_length_),
-            sizeof(AudioOutputBufferParameters) +
-                AudioBus::CalculateMemorySize(audio_parameters_));
 
   AudioOutputBuffer* buffer =
       reinterpret_cast<AudioOutputBuffer*>(shared_memory_.memory());

diff --git a/media/audio/audio_output_device.h b/media/audio/audio_output_device.h
index 88e1843..47d16f8 100644
--- a/media/audio/audio_output_device.h
+++ b/media/audio/audio_output_device.h

@@ -119,8 +119,7 @@
                           const media::AudioParameters& output_params,
                           const std::string& matched_device_id) override;
   void OnStreamCreated(base::SharedMemoryHandle handle,
-                       base::SyncSocket::Handle socket_handle,
-                       int length) override;
+                       base::SyncSocket::Handle socket_handle) override;
   void OnIPCClosed() override;
 
  protected:

diff --git a/media/audio/audio_output_device_unittest.cc b/media/audio/audio_output_device_unittest.cc
index 9d05f64..b6a866c5 100644
--- a/media/audio/audio_output_device_unittest.cc
+++ b/media/audio/audio_output_device_unittest.cc

@@ -155,12 +155,6 @@
   DISALLOW_COPY_AND_ASSIGN(AudioOutputDeviceTest);
 };
 
-int AudioOutputDeviceTest::CalculateMemorySize() {
-  // Calculate output memory size.
-  return sizeof(AudioOutputBufferParameters) +
-         AudioBus::CalculateMemorySize(default_audio_parameters_);
-}
-
 AudioOutputDeviceTest::AudioOutputDeviceTest()
     : device_status_(OUTPUT_DEVICE_STATUS_ERROR_INTERNAL) {
   default_audio_parameters_.Reset(AudioParameters::AUDIO_PCM_LINEAR,
@@ -228,7 +222,8 @@
 }
 
 void AudioOutputDeviceTest::CreateStream() {
-  const int kMemorySize = CalculateMemorySize();
+  const uint32_t kMemorySize =
+      ComputeAudioOutputBufferSize(default_audio_parameters_);
 
   ASSERT_TRUE(shared_memory_.CreateAndMapAnonymous(kMemorySize));
   memset(shared_memory_.memory(), 0xff, kMemorySize);
@@ -250,7 +245,7 @@
   // https://crbug.com/640840.
   audio_device_->OnStreamCreated(
       duplicated_memory_handle,
-      SyncSocket::UnwrapHandle(audio_device_socket_descriptor), kMemorySize);
+      SyncSocket::UnwrapHandle(audio_device_socket_descriptor));
   base::RunLoop().RunUntilIdle();
 }
 

diff --git a/media/audio/audio_output_ipc.h b/media/audio/audio_output_ipc.h
index 8dc26dc..159a089 100644
--- a/media/audio/audio_output_ipc.h
+++ b/media/audio/audio_output_ipc.h

@@ -40,8 +40,7 @@
   // must read from this socket and provide audio whenever data (search for
   // "pending_bytes") is received.
   virtual void OnStreamCreated(base::SharedMemoryHandle handle,
-                               base::SyncSocket::Handle socket_handle,
-                               int length) = 0;
+                               base::SyncSocket::Handle socket_handle) = 0;
 
   // Called when the AudioOutputIPC object is going away and/or when the IPC
   // channel has been closed and no more ipc requests can be made.

diff --git a/media/base/audio_parameters.cc b/media/base/audio_parameters.cc
index ca32815..a1ae7696 100644
--- a/media/base/audio_parameters.cc
+++ b/media/base/audio_parameters.cc

@@ -9,6 +9,52 @@
 
 namespace media {
 
+base::CheckedNumeric<uint32_t> ComputeAudioInputBufferSizeChecked(
+    const AudioParameters& parameters,
+    uint32_t shared_memory_count) {
+  base::CheckedNumeric<uint32_t> result = AudioBus::CalculateMemorySize(
+      parameters.channels(), parameters.frames_per_buffer());
+  result += sizeof(media::AudioInputBufferParameters);
+  result *= shared_memory_count;
+  return result;
+}
+
+uint32_t ComputeAudioInputBufferSize(const AudioParameters& parameters,
+                                     uint32_t shared_memory_count) {
+  return ComputeAudioInputBufferSizeChecked(parameters, shared_memory_count)
+      .ValueOrDie();
+}
+
+uint32_t ComputeAudioInputBufferSize(int channels,
+                                     int frames,
+                                     uint32_t shared_memory_count) {
+  base::CheckedNumeric<uint32_t> result =
+      AudioBus::CalculateMemorySize(channels, frames);
+  result += sizeof(media::AudioInputBufferParameters);
+  result *= shared_memory_count;
+  return result.ValueOrDie();
+}
+
+base::CheckedNumeric<uint32_t> ComputeAudioOutputBufferSizeChecked(
+    const AudioParameters& parameters) {
+  base::CheckedNumeric<uint32_t> result = AudioBus::CalculateMemorySize(
+      parameters.channels(), parameters.frames_per_buffer());
+  result += sizeof(media::AudioOutputBufferParameters);
+  return result;
+}
+
+uint32_t ComputeAudioOutputBufferSize(const AudioParameters& parameters) {
+  return ComputeAudioOutputBufferSize(parameters.channels(),
+                                      parameters.frames_per_buffer());
+}
+
+uint32_t ComputeAudioOutputBufferSize(int channels, int frames) {
+  base::CheckedNumeric<uint32_t> result =
+      AudioBus::CalculateMemorySize(channels, frames);
+  result += sizeof(media::AudioOutputBufferParameters);
+  return result.ValueOrDie();
+}
+
 AudioParameters::AudioParameters()
     : AudioParameters(AUDIO_PCM_LINEAR, CHANNEL_LAYOUT_NONE, 0, 0, 0) {}
 

diff --git a/media/base/audio_parameters.h b/media/base/audio_parameters.h
index 40361f8..70204a8 100644
--- a/media/base/audio_parameters.h
+++ b/media/base/audio_parameters.h

@@ -7,8 +7,10 @@
 
 #include <stdint.h>
 #include <string>
+#include <vector>
 
 #include "base/compiler_specific.h"
+#include "base/numerics/checked_math.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "media/base/audio_bus.h"
@@ -71,6 +73,34 @@
   int8_t audio[1];
 };
 
+// These convenience function safely computes the size required for
+// |shared_memory_count| AudioInputBuffers, with enough memory for AudioBus
+// data, using |paremeters| (or alternatively |channels| and |frames|). The
+// functions not returning a CheckedNumeric will CHECK on overflow.
+MEDIA_SHMEM_EXPORT base::CheckedNumeric<uint32_t>
+ComputeAudioInputBufferSizeChecked(const AudioParameters& parameters,
+                                   uint32_t audio_bus_count);
+
+MEDIA_SHMEM_EXPORT uint32_t
+ComputeAudioInputBufferSize(const AudioParameters& parameters,
+                            uint32_t audio_bus_count);
+
+MEDIA_SHMEM_EXPORT uint32_t
+ComputeAudioInputBufferSize(int channels, int frames, uint32_t audio_bus_count);
+
+// These convenience functions safely computes the size required for an
+// AudioOutputBuffer with enough memory for AudioBus data using |parameters| (or
+// alternatively |channels| and |frames|). The functions not returning a
+// CheckedNumeric will CHECK on overflow.
+MEDIA_SHMEM_EXPORT base::CheckedNumeric<uint32_t>
+ComputeAudioOutputBufferSizeChecked(const AudioParameters& parameters);
+
+MEDIA_SHMEM_EXPORT uint32_t
+ComputeAudioOutputBufferSize(const AudioParameters& parameters);
+
+MEDIA_SHMEM_EXPORT uint32_t ComputeAudioOutputBufferSize(int channels,
+                                                         int frames);
+
 class MEDIA_SHMEM_EXPORT AudioParameters {
  public:
   // TODO(miu): Rename this enum to something that correctly reflects its

diff --git a/media/base/bit_reader_fuzzertest.cc b/media/base/bit_reader_fuzzertest.cc
index 762a9b63..7056e00b 100644
--- a/media/base/bit_reader_fuzzertest.cc
+++ b/media/base/bit_reader_fuzzertest.cc

@@ -17,7 +17,7 @@
   // Need a simple random number generator to generate the number of bits to
   // read/skip in a reproducible way (given the same |data|). Using Hash() to
   // ensure the seed varies significantly over minor changes in |data|.
-  media::TestRandom rnd(base::Hash(reinterpret_cast<const char*>(data), size));
+  media::TestRandom rnd(base::Hash(data, size));
 
   // Read and skip through the data in |reader|.
   while (reader.bits_available() > 0) {

diff --git a/mojo/public/cpp/bindings/binding.h b/mojo/public/cpp/bindings/binding.h
index b0e2224..409f9cd 100644
--- a/mojo/public/cpp/bindings/binding.h
+++ b/mojo/public/cpp/bindings/binding.h

@@ -229,6 +229,11 @@
     return internal_state_.RouterForTesting();
   }
 
+  // Allows test code to swap the interface implementation.
+  ImplPointerType SwapImplForTesting(ImplPointerType new_impl) {
+    return internal_state_.SwapImplForTesting(new_impl);
+  }
+
  private:
   internal::BindingState<Interface, ImplRefTraits> internal_state_;
 

diff --git a/mojo/public/cpp/bindings/binding_set.h b/mojo/public/cpp/bindings/binding_set.h
index 7e5ece2..737affb0 100644
--- a/mojo/public/cpp/bindings/binding_set.h
+++ b/mojo/public/cpp/bindings/binding_set.h

@@ -123,6 +123,18 @@
     return true;
   }
 
+  // Swaps the interface implementation with a different one, to allow tests
+  // to modify behavior.
+  //
+  // Returns the existing interface implementation to the caller.
+  ImplPointerType SwapImplForTesting(BindingId id, ImplPointerType new_impl) {
+    auto it = bindings_.find(id);
+    if (it == bindings_.end())
+      return nullptr;
+
+    return it->second->SwapImplForTesting(new_impl);
+  }
+
   void CloseAllBindings() { bindings_.clear(); }
 
   bool empty() const { return bindings_.empty(); }
@@ -216,6 +228,10 @@
 
     void FlushForTesting() { binding_.FlushForTesting(); }
 
+    ImplPointerType SwapImplForTesting(ImplPointerType new_impl) {
+      return binding_.SwapImplForTesting(new_impl);
+    }
+
    private:
     class DispatchFilter : public MessageReceiver {
      public:

diff --git a/mojo/public/cpp/bindings/lib/binding_state.h b/mojo/public/cpp/bindings/lib/binding_state.h
index 465951a..4d9be92 100644
--- a/mojo/public/cpp/bindings/lib/binding_state.h
+++ b/mojo/public/cpp/bindings/lib/binding_state.h

@@ -121,6 +121,11 @@
   }
 
   Interface* impl() { return ImplRefTraits::GetRawPointer(&stub_.sink()); }
+  ImplPointerType SwapImplForTesting(ImplPointerType new_impl) {
+    Interface* old_impl = impl();
+    stub_.set_sink(std::move(new_impl));
+    return old_impl;
+  }
 
  private:
   typename Interface::template Stub_<ImplRefTraits> stub_;

diff --git a/mojo/public/tools/bindings/chromium_bindings_configuration.gni b/mojo/public/tools/bindings/chromium_bindings_configuration.gni
index 6fe236d..976edf3 100644
--- a/mojo/public/tools/bindings/chromium_bindings_configuration.gni
+++ b/mojo/public/tools/bindings/chromium_bindings_configuration.gni

@@ -30,6 +30,7 @@
   "//net/interfaces/typemaps.gni",
   "//services/device/public/interfaces/typemaps.gni",
   "//services/identity/public/cpp/typemaps.gni",
+  "//services/network/public/cpp/typemaps.gni",
   "//services/preferences/public/cpp/typemaps.gni",
   "//services/resource_coordinator/public/cpp/typemaps.gni",
   "//services/service_manager/public/cpp/typemaps.gni",

diff --git a/mojo/public/tools/bindings/generators/cpp_templates/interface_declaration.tmpl b/mojo/public/tools/bindings/generators/cpp_templates/interface_declaration.tmpl
index f5acd37..4221832 100644
--- a/mojo/public/tools/bindings/generators/cpp_templates/interface_declaration.tmpl
+++ b/mojo/public/tools/bindings/generators/cpp_templates/interface_declaration.tmpl

@@ -69,6 +69,6 @@
   virtual {{interface.name}}* GetForwardingInterface() = 0;
 
 {%- for method in interface.methods %}
-  void {{method.name}}({{interface_macros.declare_request_params("", method, use_once_callback)}});
+  void {{method.name}}({{interface_macros.declare_request_params("", method, use_once_callback)}}) override;
 {%- endfor %}
 };

diff --git a/net/BUILD.gn b/net/BUILD.gn
index e862ec7..d12cbe4 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn

@@ -1402,6 +1402,8 @@
       "quic/platform/api/quic_logging.h",
       "quic/platform/api/quic_lru_cache.h",
       "quic/platform/api/quic_map_util.h",
+      "quic/platform/api/quic_mem_slice.h",
+      "quic/platform/api/quic_mem_slice_span.h",
       "quic/platform/api/quic_mutex.cc",
       "quic/platform/api/quic_mutex.h",
       "quic/platform/api/quic_pcc_sender.h",
@@ -1435,6 +1437,10 @@
       "quic/platform/impl/quic_logging_impl.h",
       "quic/platform/impl/quic_lru_cache_impl.h",
       "quic/platform/impl/quic_map_util_impl.h",
+      "quic/platform/impl/quic_mem_slice_impl.cc",
+      "quic/platform/impl/quic_mem_slice_impl.h",
+      "quic/platform/impl/quic_mem_slice_span_impl.cc",
+      "quic/platform/impl/quic_mem_slice_span_impl.h",
       "quic/platform/impl/quic_mutex_impl.cc",
       "quic/platform/impl/quic_mutex_impl.h",
       "quic/platform/impl/quic_pcc_sender_impl.h",
@@ -3129,10 +3135,13 @@
     "quic/platform/api/quic_test.h",
     "quic/platform/api/quic_test_loopback.cc",
     "quic/platform/api/quic_test_loopback.h",
+    "quic/platform/api/quic_test_mem_slice_vector.h",
     "quic/platform/impl/quic_test_impl.cc",
     "quic/platform/impl/quic_test_impl.h",
     "quic/platform/impl/quic_test_loopback_impl.cc",
     "quic/platform/impl/quic_test_loopback_impl.h",
+    "quic/platform/impl/quic_test_mem_slice_vector_impl.cc",
+    "quic/platform/impl/quic_test_mem_slice_vector_impl.h",
     "quic/test_tools/crypto_test_utils.cc",
     "quic/test_tools/crypto_test_utils.h",
     "quic/test_tools/failing_proof_source.cc",
@@ -5083,6 +5092,8 @@
     "quic/platform/api/quic_endian_test.cc",
     "quic/platform/api/quic_hostname_utils_test.cc",
     "quic/platform/api/quic_lru_cache_test.cc",
+    "quic/platform/api/quic_mem_slice_span_test.cc",
+    "quic/platform/api/quic_mem_slice_test.cc",
     "quic/platform/api/quic_reference_counted_test.cc",
     "quic/platform/api/quic_str_cat_test.cc",
     "quic/platform/api/quic_text_utils_test.cc",

diff --git a/net/cert/internal/path_builder.cc b/net/cert/internal/path_builder.cc
index e6bde35b..39ef75a 100644
--- a/net/cert/internal/path_builder.cc
+++ b/net/cert/internal/path_builder.cc

@@ -249,6 +249,9 @@
 // CertIssuerIterPath tracks which certs are present in the path and prevents
 // paths from being built which repeat any certs (including different versions
 // of the same cert, based on Subject+SubjectAltName+SPKI).
+// (RFC 5280 forbids duplicate certificates per section 6.1, and RFC 4158
+// further recommends disallowing the same Subject+SubjectAltName+SPKI in
+// section 2.4.2.)
 class CertIssuerIterPath {
  public:
   // Returns true if |cert| is already present in the path.
@@ -362,23 +365,11 @@
   // CertPathIter.
   void AddCertIssuerSource(CertIssuerSource* cert_issuer_source);
 
-  // Gets the next candidate path, or clears |*path| when all paths have been
-  // exhausted.
-  void GetNextPath(CertPath* path);
+  // Gets the next candidate path, or clears |*out_path| when all paths have
+  // been exhausted.
+  void GetNextPath(CertPath* out_path);
 
  private:
-  enum State {
-    STATE_NONE,
-    STATE_GET_NEXT_ISSUER,
-    STATE_GET_NEXT_ISSUER_COMPLETE,
-    STATE_RETURN_A_PATH,
-    STATE_BACKTRACK,
-  };
-
-  void DoGetNextIssuer();
-  void DoGetNextIssuerComplete();
-  void DoBackTrack();
-
   // Stores the next candidate issuer, until it is used during the
   // STATE_GET_NEXT_ISSUER_COMPLETE step.
   IssuerEntry next_issuer_;
@@ -390,18 +381,13 @@
   CertIssuerSources cert_issuer_sources_;
   // The TrustStore for checking if a path ends in a trust anchor.
   const TrustStore* trust_store_;
-  // The output variable for storing the next candidate path, which the client
-  // passes in to GetNextPath. Only used for a single path output.
-  CertPath* out_path_;
-  // Current state of the state machine.
-  State next_state_;
 
   DISALLOW_COPY_AND_ASSIGN(CertPathIter);
 };
 
 CertPathIter::CertPathIter(scoped_refptr<ParsedCertificate> cert,
                            const TrustStore* trust_store)
-    : trust_store_(trust_store), next_state_(STATE_GET_NEXT_ISSUER_COMPLETE) {
+    : trust_store_(trust_store) {
   // Initialize |next_issuer_| to the target certificate.
   next_issuer_.cert = std::move(cert);
   trust_store_->GetTrust(next_issuer_.cert, &next_issuer_.trust);
@@ -411,102 +397,61 @@
   cert_issuer_sources_.push_back(cert_issuer_source);
 }
 
-// TODO(eroman): Simplify (doesn't need to use the "DoLoop" pattern).
-void CertPathIter::GetNextPath(CertPath* path) {
-  out_path_ = path;
-  out_path_->Clear();
-  do {
-    State state = next_state_;
-    next_state_ = STATE_NONE;
-    switch (state) {
-      case STATE_NONE:
-        NOTREACHED();
-        break;
-      case STATE_GET_NEXT_ISSUER:
-        DoGetNextIssuer();
-        break;
-      case STATE_GET_NEXT_ISSUER_COMPLETE:
-        DoGetNextIssuerComplete();
-        break;
-      case STATE_RETURN_A_PATH:
-        // If the returned path did not verify, keep looking for other paths
-        // (the trust root is not part of cur_path_, so don't need to
-        // backtrack).
-        next_state_ = STATE_GET_NEXT_ISSUER;
-        break;
-      case STATE_BACKTRACK:
-        DoBackTrack();
-        break;
-    }
-  } while (next_state_ != STATE_NONE && next_state_ != STATE_RETURN_A_PATH);
-
-  out_path_ = nullptr;
-}
-
-void CertPathIter::DoGetNextIssuer() {
-  if (cur_path_.Empty()) {
-    // Exhausted all paths.
-    next_state_ = STATE_NONE;
-  } else {
-    next_state_ = STATE_GET_NEXT_ISSUER_COMPLETE;
-    cur_path_.back()->GetNextIssuer(&next_issuer_);
-  }
-}
-
-void CertPathIter::DoGetNextIssuerComplete() {
-  if (!next_issuer_.cert) {
-    // TODO(mattm): should also include such paths in CertPathBuilder::Result,
-    // maybe with a flag to enable it. Or use a visitor pattern so the caller
-    // can decide what to do with any failed paths.
-    // No more issuers for current chain, go back up and see if there are any
-    // more for the previous cert.
-    next_state_ = STATE_BACKTRACK;
-    return;
-  }
-
-  switch (next_issuer_.trust.type) {
-    // If the trust for this issuer is "known" (either becuase it is distrusted,
-    // or because it is trusted) then stop building and return the path.
-    case CertificateTrustType::DISTRUSTED:
-    case CertificateTrustType::TRUSTED_ANCHOR:
-    case CertificateTrustType::TRUSTED_ANCHOR_WITH_CONSTRAINTS: {
-      // If the issuer has a known trust level, can stop building the path.
-      DVLOG(1) << "CertPathIter got anchor: "
-               << CertDebugString(next_issuer_.cert.get());
-      next_state_ = STATE_RETURN_A_PATH;
-      cur_path_.CopyPath(&out_path_->certs);
-      out_path_->certs.push_back(std::move(next_issuer_.cert));
-      out_path_->last_cert_trust = next_issuer_.trust;
-      next_issuer_ = IssuerEntry();
-      break;
-    }
-    case CertificateTrustType::UNSPECIFIED: {
-      // Skip this cert if it is already in the chain.
-      if (cur_path_.IsPresent(next_issuer_.cert.get())) {
-        next_state_ = STATE_GET_NEXT_ISSUER;
-        break;
+void CertPathIter::GetNextPath(CertPath* out_path) {
+  out_path->Clear();
+  while (true) {
+    if (!next_issuer_.cert) {
+      if (cur_path_.Empty()) {
+        DVLOG(1) << "CertPathIter exhausted all paths...";
+        return;
       }
-
-      cur_path_.Append(std::make_unique<CertIssuersIter>(
-          std::move(next_issuer_.cert), &cert_issuer_sources_, trust_store_));
-      next_issuer_ = IssuerEntry();
-      DVLOG(1) << "CertPathIter cur_path_ = " << cur_path_.PathDebugString();
-      // Continue descending the tree.
-      next_state_ = STATE_GET_NEXT_ISSUER;
-      break;
+      cur_path_.back()->GetNextIssuer(&next_issuer_);
+      if (!next_issuer_.cert) {
+        // TODO(mattm): should also include such paths in
+        // CertPathBuilder::Result, maybe with a flag to enable it. Or use a
+        // visitor pattern so the caller can decide what to do with any failed
+        // paths. No more issuers for current chain, go back up and see if there
+        // are any more for the previous cert.
+        DVLOG(1) << "CertPathIter backtracking...";
+        cur_path_.Pop();
+        // Continue exploring issuers of the previous path...
+        continue;
+      }
     }
-  }
-}
 
-void CertPathIter::DoBackTrack() {
-  DVLOG(1) << "CertPathIter backtracking...";
-  cur_path_.Pop();
-  if (cur_path_.Empty()) {
-    // Exhausted all paths.
-    next_state_ = STATE_NONE;
-  } else {
-    // Continue exploring issuers of the previous path.
-    next_state_ = STATE_GET_NEXT_ISSUER;
+    switch (next_issuer_.trust.type) {
+      // If the trust for this issuer is "known" (either becuase it is
+      // distrusted, or because it is trusted) then stop building and return the
+      // path.
+      case CertificateTrustType::DISTRUSTED:
+      case CertificateTrustType::TRUSTED_ANCHOR:
+      case CertificateTrustType::TRUSTED_ANCHOR_WITH_CONSTRAINTS: {
+        // If the issuer has a known trust level, can stop building the path.
+        DVLOG(1) << "CertPathIter got anchor: "
+                 << CertDebugString(next_issuer_.cert.get());
+        cur_path_.CopyPath(&out_path->certs);
+        out_path->certs.push_back(std::move(next_issuer_.cert));
+        out_path->last_cert_trust = next_issuer_.trust;
+        next_issuer_ = IssuerEntry();
+        return;
+      }
+      case CertificateTrustType::UNSPECIFIED: {
+        // Skip this cert if it is already in the chain.
+        if (cur_path_.IsPresent(next_issuer_.cert.get())) {
+          DVLOG(1) << "CertPathIter skipping dupe cert: "
+                   << CertDebugString(next_issuer_.cert.get());
+          next_issuer_ = IssuerEntry();
+          continue;
+        }
+
+        cur_path_.Append(std::make_unique<CertIssuersIter>(
+            std::move(next_issuer_.cert), &cert_issuer_sources_, trust_store_));
+        next_issuer_ = IssuerEntry();
+        DVLOG(1) << "CertPathIter cur_path_ = " << cur_path_.PathDebugString();
+        // Continue descending the tree.
+        continue;
+      }
+    }
   }
 }
 
@@ -563,7 +508,6 @@
       user_initial_policy_set_(user_initial_policy_set),
       initial_policy_mapping_inhibit_(initial_policy_mapping_inhibit),
       initial_any_policy_inhibit_(initial_any_policy_inhibit),
-      next_state_(STATE_NONE),
       out_result_(result) {
   DCHECK(delegate);
   result->Clear();
@@ -578,71 +522,42 @@
   cert_path_iter_->AddCertIssuerSource(cert_issuer_source);
 }
 
-// TODO(eroman): Simplify (doesn't need to use the "DoLoop" pattern).
 void CertPathBuilder::Run() {
-  DCHECK_EQ(STATE_NONE, next_state_);
-  next_state_ = STATE_GET_NEXT_PATH;
-
-  do {
-    State state = next_state_;
-    next_state_ = STATE_NONE;
-    switch (state) {
-      case STATE_NONE:
-        NOTREACHED();
-        break;
-      case STATE_GET_NEXT_PATH:
-        DoGetNextPath();
-        break;
-      case STATE_GET_NEXT_PATH_COMPLETE:
-        DoGetNextPathComplete();
-        break;
+  CertPath next_path;
+  while (true) {
+    cert_path_iter_->GetNextPath(&next_path);
+    if (next_path.IsEmpty()) {
+      // No more paths to check.
+      return;
     }
-  } while (next_state_ != STATE_NONE);
-}
 
-void CertPathBuilder::DoGetNextPath() {
-  next_state_ = STATE_GET_NEXT_PATH_COMPLETE;
-  cert_path_iter_->GetNextPath(&next_path_);
-}
+    // Verify the entire certificate chain.
+    auto result_path = std::make_unique<ResultPath>();
+    result_path->path = next_path;
+    VerifyCertificateChain(
+        result_path->path.certs, result_path->path.last_cert_trust, delegate_,
+        time_, key_purpose_, initial_explicit_policy_, user_initial_policy_set_,
+        initial_policy_mapping_inhibit_, initial_any_policy_inhibit_,
+        &result_path->user_constrained_policy_set, &result_path->errors);
 
-void CertPathBuilder::DoGetNextPathComplete() {
-  if (next_path_.IsEmpty()) {
-    // No more paths to check, signal completion.
-    next_state_ = STATE_NONE;
-    return;
+    DVLOG(1) << "CertPathBuilder VerifyCertificateChain errors:\n"
+             << result_path->errors.ToDebugString(result_path->path.certs);
+
+    // Give the delegate a chance to add errors to the path.
+    delegate_->CheckPathAfterVerification(result_path->path,
+                                          &result_path->errors);
+
+    bool path_is_good = result_path->IsValid();
+
+    AddResultPath(std::move(result_path));
+
+    if (path_is_good) {
+      // Found a valid path, return immediately.
+      // TODO(mattm): add debug/test mode that tries all possible paths.
+      return;
+    }
+    // Path did not verify. Try more paths.
   }
-
-  // Verify the entire certificate chain.
-  auto result_path = std::make_unique<ResultPath>();
-  result_path->path = next_path_;
-  VerifyCertificateChain(
-      result_path->path.certs, result_path->path.last_cert_trust, delegate_,
-      time_, key_purpose_, initial_explicit_policy_, user_initial_policy_set_,
-      initial_policy_mapping_inhibit_, initial_any_policy_inhibit_,
-      &result_path->user_constrained_policy_set, &result_path->errors);
-
-  DVLOG(1) << "CertPathBuilder VerifyCertificateChain errors:\n"
-           << result_path->errors.ToDebugString(result_path->path.certs);
-
-  // Give the delegate a chance to add errors to the path.
-  delegate_->CheckPathAfterVerification(result_path->path,
-                                        &result_path->errors);
-
-  bool path_is_good = result_path->IsValid();
-
-  AddResultPath(std::move(result_path));
-
-  if (path_is_good) {
-    // Found a valid path, return immediately.
-    // TODO(mattm): add debug/test mode that tries all possible paths.
-    next_state_ = STATE_NONE;
-    return;
-  }
-
-  // Path did not verify. Try more paths. If there are no more paths, the result
-  // will be returned next time DoGetNextPathComplete is called with next_path_
-  // empty.
-  next_state_ = STATE_GET_NEXT_PATH;
 }
 
 void CertPathBuilder::AddResultPath(std::unique_ptr<ResultPath> result_path) {

diff --git a/net/cert/internal/path_builder.h b/net/cert/internal/path_builder.h
index ba53290a..34184a4 100644
--- a/net/cert/internal/path_builder.h
+++ b/net/cert/internal/path_builder.h

@@ -171,15 +171,6 @@
   void Run();
 
  private:
-  enum State {
-    STATE_NONE,
-    STATE_GET_NEXT_PATH,
-    STATE_GET_NEXT_PATH_COMPLETE,
-  };
-
-  void DoGetNextPath();
-  void DoGetNextPathComplete();
-
   void AddResultPath(std::unique_ptr<ResultPath> result_path);
 
   std::unique_ptr<CertPathIter> cert_path_iter_;
@@ -191,15 +182,6 @@
   const InitialPolicyMappingInhibit initial_policy_mapping_inhibit_;
   const InitialAnyPolicyInhibit initial_any_policy_inhibit_;
 
-  // Stores the next complete path to attempt verification on. This is filled in
-  // by |cert_path_iter_| during the STATE_GET_NEXT_PATH step, and thus should
-  // only be accessed during the STATE_GET_NEXT_PATH_COMPLETE step.
-  // (Will be empty if all paths have been tried, otherwise will be a candidate
-  // path starting with the target cert and ending with a
-  // certificate issued by trust anchor.)
-  CertPath next_path_;
-  State next_state_;
-
   Result* out_result_;
 
   DISALLOW_COPY_AND_ASSIGN(CertPathBuilder);

diff --git a/net/cert/internal/trust_store_mac_unittest.cc b/net/cert/internal/trust_store_mac_unittest.cc
index 400ba3f..70a3775a 100644
--- a/net/cert/internal/trust_store_mac_unittest.cc
+++ b/net/cert/internal/trust_store_mac_unittest.cc

@@ -204,8 +204,7 @@
 
 // Test against all the certificates in the default keychains. Confirms that
 // the computed trust value matches that of SecTrustEvaluate.
-// Fails on Mac 10.12. See http://crbug.com/757540.
-TEST(TrustStoreMacTest, DISABLED_SystemCerts) {
+TEST(TrustStoreMacTest, SystemCerts) {
   // Get the list of all certificates in the user & system keychains.
   // This may include both trusted and untrusted certificates.
   //
@@ -284,9 +283,9 @@
                 SecTrustCreateWithCertificates(cert_handle, sec_policy,
                                                trust.InitializeInto()));
       ASSERT_EQ(noErr,
-                SecTrustSetOptions(
-                    trust,
-                    kSecTrustOptionLeafIsCA | kSecTrustOptionAllowExpiredRoot));
+                SecTrustSetOptions(trust, kSecTrustOptionLeafIsCA |
+                                              kSecTrustOptionAllowExpired |
+                                              kSecTrustOptionAllowExpiredRoot));
 
       SecTrustResultType trust_result;
       ASSERT_EQ(noErr, SecTrustEvaluate(trust, &trust_result));

diff --git a/net/cert/x509_util_nss.cc b/net/cert/x509_util_nss.cc
index 50cf746..67cc2b3b 100644
--- a/net/cert/x509_util_nss.cc
+++ b/net/cert/x509_util_nss.cc

@@ -232,6 +232,15 @@
   return ScopedCERTCertificate(CERT_DupCertificate(cert));
 }
 
+ScopedCERTCertificateList DupCERTCertificateList(
+    const ScopedCERTCertificateList& certs) {
+  ScopedCERTCertificateList result;
+  result.reserve(certs.size());
+  for (const ScopedCERTCertificate& cert : certs)
+    result.push_back(DupCERTCertificate(cert.get()));
+  return result;
+}
+
 scoped_refptr<X509Certificate> CreateX509CertificateFromCERTCertificate(
     CERTCertificate* nss_cert,
     const std::vector<CERTCertificate*>& nss_chain) {
@@ -400,6 +409,18 @@
   return std::string();
 }
 
+bool GetValidityTimes(CERTCertificate* cert,
+                      base::Time* not_before,
+                      base::Time* not_after) {
+  PRTime pr_not_before, pr_not_after;
+  if (CERT_GetCertTimes(cert, &pr_not_before, &pr_not_after) == SECSuccess) {
+    *not_before = crypto::PRTimeToBaseTime(pr_not_before);
+    *not_after = crypto::PRTimeToBaseTime(pr_not_after);
+    return true;
+  }
+  return false;
+}
+
 SHA256HashValue CalculateFingerprint256(CERTCertificate* cert) {
   SHA256HashValue sha256;
   memset(sha256.data, 0, sizeof(sha256.data));

diff --git a/net/cert/x509_util_nss.h b/net/cert/x509_util_nss.h
index fe950d8b..3e144f9 100644
--- a/net/cert/x509_util_nss.h
+++ b/net/cert/x509_util_nss.h

@@ -56,6 +56,11 @@
 // Increments the refcount of |cert| and returns a handle for that reference.
 NET_EXPORT ScopedCERTCertificate DupCERTCertificate(CERTCertificate* cert);
 
+// Increments the refcount of each element in |cerst| and returns a list of
+// handles for them.
+NET_EXPORT ScopedCERTCertificateList
+DupCERTCertificateList(const ScopedCERTCertificateList& certs);
+
 // Creates an X509Certificate from |cert|, with intermediates from |chain|.
 // Returns NULL on failure.
 NET_EXPORT scoped_refptr<X509Certificate>
@@ -116,6 +121,12 @@
 // This mirrors net::CertPrincipal::GetDisplayName.
 NET_EXPORT std::string GetCERTNameDisplayName(CERTName* name);
 
+// Stores the notBefore and notAfter times from |cert| into |*not_before| and
+// |*not_after|, returning true if successful.
+NET_EXPORT bool GetValidityTimes(CERTCertificate* cert,
+                                 base::Time* not_before,
+                                 base::Time* not_after);
+
 // Calculates the SHA-256 fingerprint of the certificate.  Returns an empty
 // (all zero) fingerprint on failure.
 NET_EXPORT SHA256HashValue CalculateFingerprint256(CERTCertificate* cert);

diff --git a/net/cert/x509_util_nss_unittest.cc b/net/cert/x509_util_nss_unittest.cc
index 96154514..458fd00f 100644
--- a/net/cert/x509_util_nss_unittest.cc
+++ b/net/cert/x509_util_nss_unittest.cc

@@ -172,6 +172,39 @@
       cert2->subjectName);
 }
 
+TEST(X509UtilNSSTest, DupCERTCertificateList) {
+  ScopedCERTCertificate cert(x509_util::CreateCERTCertificateFromBytes(
+      google_der, arraysize(google_der)));
+  ASSERT_TRUE(cert);
+  ScopedCERTCertificate cert2(x509_util::CreateCERTCertificateFromBytes(
+      webkit_der, arraysize(webkit_der)));
+  ASSERT_TRUE(cert2);
+  ScopedCERTCertificateList certs;
+  certs.push_back(std::move(cert));
+  certs.push_back(std::move(cert2));
+
+  ScopedCERTCertificateList certs_dup =
+      x509_util::DupCERTCertificateList(certs);
+  ASSERT_EQ(2U, certs_dup.size());
+  ASSERT_EQ(certs[0].get(), certs_dup[0].get());
+  ASSERT_EQ(certs[1].get(), certs_dup[1].get());
+
+  // Release the initial handles.
+  certs.clear();
+  // The duped handles should still be safe to access.
+  EXPECT_STREQ(
+      "CN=www.google.com,O=Google Inc,L=Mountain View,ST=California,C=US",
+      certs_dup[0]->subjectName);
+  EXPECT_STREQ(
+      "CN=*.webkit.org,OU=Mac OS Forge,O=Apple "
+      "Inc.,L=Cupertino,ST=California,C=US",
+      certs_dup[1]->subjectName);
+}
+
+TEST(X509UtilNSSTest, DupCERTCertificateList_EmptyList) {
+  EXPECT_EQ(0U, x509_util::DupCERTCertificateList({}).size());
+}
+
 TEST(X509UtilNSSTest, CreateX509CertificateFromCERTCertificate_NoChain) {
   ScopedCERTCertificate nss_cert(x509_util::CreateCERTCertificateFromBytes(
       google_der, arraysize(google_der)));
@@ -321,6 +354,22 @@
   EXPECT_EQ("santest@ad.corp.example.com", upn_names[0]);
 }
 
+TEST(X509UtilNSSTest, GetValidityTimes) {
+  ScopedCERTCertificate google_cert(x509_util::CreateCERTCertificateFromBytes(
+      google_der, arraysize(google_der)));
+  ASSERT_TRUE(google_cert);
+
+  base::Time not_before, not_after;
+  EXPECT_TRUE(
+      x509_util::GetValidityTimes(google_cert.get(), &not_before, &not_after));
+
+  // Constants copied from x509_certificate_unittest.cc.
+  EXPECT_EQ(1238192407,  // Mar 27 22:20:07 2009 GMT
+            not_before.ToDoubleT());
+  EXPECT_EQ(1269728407,  // Mar 27 22:20:07 2010 GMT
+            not_after.ToDoubleT());
+}
+
 TEST(X509UtilNSSTest, CalculateFingerprint256) {
   static const SHA256HashValue google_fingerprint = {
       {0x21, 0xaf, 0x58, 0x74, 0xea, 0x6b, 0xad, 0xbd, 0xe4, 0xb3, 0xb1,

diff --git a/net/disk_cache/blockfile/storage_block-inl.h b/net/disk_cache/blockfile/storage_block-inl.h
index 3d880bb9..828df3a 100644
--- a/net/disk_cache/blockfile/storage_block-inl.h
+++ b/net/disk_cache/blockfile/storage_block-inl.h

@@ -201,7 +201,7 @@
 
 template <typename T>
 uint32_t StorageBlock<T>::CalculateHash() const {
-  return base::Hash(reinterpret_cast<char*>(data_), offsetof(T, self_hash));
+  return base::Hash(data_, offsetof(T, self_hash));
 }
 
 }  // namespace disk_cache

diff --git a/net/http/http_request_headers.cc b/net/http/http_request_headers.cc
index b2fec43..65659b4 100644
--- a/net/http/http_request_headers.cc
+++ b/net/http/http_request_headers.cc

@@ -94,13 +94,9 @@
 
 void HttpRequestHeaders::SetHeader(const base::StringPiece& key,
                                    const base::StringPiece& value) {
-  DCHECK(HttpUtil::IsValidHeaderName(key));
-  DCHECK(HttpUtil::IsValidHeaderValue(value));
-  HeaderVector::iterator it = FindHeader(key);
-  if (it != headers_.end())
-    it->value.assign(value.data(), value.size());
-  else
-    headers_.push_back(HeaderKeyValuePair(key, value));
+  DCHECK(HttpUtil::IsValidHeaderName(key)) << key;
+  DCHECK(HttpUtil::IsValidHeaderValue(value)) << key << ":" << value;
+  SetHeaderInternal(key, value);
 }
 
 void HttpRequestHeaders::SetHeaderIfMissing(const base::StringPiece& key,
@@ -229,4 +225,13 @@
   return headers_.end();
 }
 
+void HttpRequestHeaders::SetHeaderInternal(const base::StringPiece& key,
+                                           const base::StringPiece& value) {
+  HeaderVector::iterator it = FindHeader(key);
+  if (it != headers_.end())
+    it->value.assign(value.data(), value.size());
+  else
+    headers_.push_back(HeaderKeyValuePair(key, value));
+}
+
 }  // namespace net

diff --git a/net/http/http_request_headers.h b/net/http/http_request_headers.h
index 3c8a46c..c246f4f 100644
--- a/net/http/http_request_headers.h
+++ b/net/http/http_request_headers.h

@@ -28,7 +28,7 @@
 
 class NET_EXPORT HttpRequestHeaders {
  public:
-  struct HeaderKeyValuePair {
+  struct NET_EXPORT HeaderKeyValuePair {
     HeaderKeyValuePair();
     HeaderKeyValuePair(const base::StringPiece& key,
                        const base::StringPiece& value);
@@ -112,6 +112,12 @@
   // |value| passes HttpUtil::IsValidHeaderValue().
   void SetHeader(const base::StringPiece& key, const base::StringPiece& value);
 
+  // Does the same as above but without internal DCHECKs for validations.
+  void SetHeaderWithoutCheckForTesting(const base::StringPiece& key,
+                                       const base::StringPiece& value) {
+    SetHeaderInternal(key, value);
+  }
+
   // Sets the header value pair for |key| and |value|, if |key| does not exist.
   // If |key| already exists, the call is a no-op.
   // When comparing |key|, case is ignored.
@@ -167,10 +173,15 @@
       const std::string* request_line,
       NetLogCaptureMode capture_mode) const;
 
+  const HeaderVector& GetHeaderVector() const { return headers_; }
+
  private:
   HeaderVector::iterator FindHeader(const base::StringPiece& key);
   HeaderVector::const_iterator FindHeader(const base::StringPiece& key) const;
 
+  void SetHeaderInternal(const base::StringPiece& key,
+                         const base::StringPiece& value);
+
   HeaderVector headers_;
 
   // Allow the copy construction and operator= to facilitate copying in

diff --git a/net/quic/core/quic_flags_list.h b/net/quic/core/quic_flags_list.h
index e2ad9ce..721f0f5 100644
--- a/net/quic/core/quic_flags_list.h
+++ b/net/quic/core/quic_flags_list.h

@@ -209,3 +209,7 @@
 // If true, QUIC v40 is enabled which includes changes to RST_STREAM, ACK
 // and STREAM frames match IETF format.
 QUIC_FLAG(bool, FLAGS_quic_reloadable_flag_quic_enable_version_40, false)
+
+// If true, QUIC can take ownership of data provided in a reference counted
+// memory to avoid data copy.
+QUIC_FLAG(bool, FLAGS_quic_reloadable_flag_quic_use_mem_slices, false)

diff --git a/net/quic/core/quic_session.cc b/net/quic/core/quic_session.cc
index f2da800..a32f3464 100644
--- a/net/quic/core/quic_session.cc
+++ b/net/quic/core/quic_session.cc

@@ -50,7 +50,9 @@
           FLAGS_quic_reloadable_flag_quic_use_stream_notifier2),
       save_data_before_consumption_(
           use_stream_notifier_ &&
-          FLAGS_quic_reloadable_flag_quic_save_data_before_consumption2) {}
+          FLAGS_quic_reloadable_flag_quic_save_data_before_consumption2),
+      can_use_slices_(save_data_before_consumption_ &&
+                      FLAGS_quic_reloadable_flag_quic_use_mem_slices) {}
 
 void QuicSession::Initialize() {
   connection_->set_visitor(this);

diff --git a/net/quic/core/quic_session.h b/net/quic/core/quic_session.h
index b95ea36..f2bb0d6 100644
--- a/net/quic/core/quic_session.h
+++ b/net/quic/core/quic_session.h

@@ -279,6 +279,8 @@
     return save_data_before_consumption_;
   }
 
+  bool can_use_slices() const { return can_use_slices_; }
+
  protected:
   using StaticStreamMap = QuicSmallMap<QuicStreamId, QuicStream*, 2>;
 
@@ -492,6 +494,10 @@
   // Application data is saved before it is actually consumed.
   const bool save_data_before_consumption_;
 
+  // QUIC stream can take ownership of application data provided in reference
+  // counted memory to avoid data copy.
+  const bool can_use_slices_;
+
   DISALLOW_COPY_AND_ASSIGN(QuicSession);
 };
 

diff --git a/net/quic/core/quic_stream.cc b/net/quic/core/quic_stream.cc
index 4afb5c24..8980690 100644
--- a/net/quic/core/quic_stream.cc
+++ b/net/quic/core/quic_stream.cc

@@ -444,6 +444,46 @@
   return consumed_data;
 }
 
+QuicConsumedData QuicStream::WriteMemSlices(QuicMemSliceSpan span, bool fin) {
+  DCHECK(session_->can_use_slices());
+  QuicConsumedData consumed_data(0, false);
+  if (span.empty() && !fin) {
+    QUIC_BUG << "span.empty() && !fin";
+    return consumed_data;
+  }
+
+  if (fin_buffered_) {
+    QUIC_BUG << "Fin already buffered";
+    return consumed_data;
+  }
+
+  if (write_side_closed_) {
+    QUIC_DLOG(ERROR) << ENDPOINT << "Stream " << id()
+                     << "attempting to write when the write side is closed";
+    return consumed_data;
+  }
+
+  bool had_buffered_data = HasBufferedData();
+  if (CanWriteNewData() || span.empty()) {
+    consumed_data.fin_consumed = fin;
+    if (!span.empty()) {
+      // Buffer all data if buffered data size is below limit.
+      QuicStreamOffset offset = send_buffer_.stream_offset();
+      consumed_data.bytes_consumed =
+          span.SaveMemSlicesInSendBuffer(&send_buffer_);
+      OnDataBuffered(offset, consumed_data.bytes_consumed, nullptr);
+    }
+  }
+  fin_buffered_ = consumed_data.fin_consumed;
+
+  if (!had_buffered_data && (HasBufferedData() || fin_buffered_)) {
+    // Write data if there is no buffered data before.
+    WriteBufferedData();
+  }
+
+  return consumed_data;
+}
+
 QuicConsumedData QuicStream::WritevDataInner(
     QuicIOVector iov,
     QuicStreamOffset offset,

diff --git a/net/quic/core/quic_stream.h b/net/quic/core/quic_stream.h
index be60503..e36e1f4e 100644
--- a/net/quic/core/quic_stream.h
+++ b/net/quic/core/quic_stream.h

@@ -32,6 +32,7 @@
 #include "net/quic/core/quic_types.h"
 #include "net/quic/core/stream_notifier_interface.h"
 #include "net/quic/platform/api/quic_export.h"
+#include "net/quic/platform/api/quic_mem_slice_span.h"
 #include "net/quic/platform/api/quic_reference_counted.h"
 #include "net/quic/platform/api/quic_string_piece.h"
 
@@ -225,6 +226,10 @@
       bool fin,
       QuicReferenceCountedPointer<QuicAckListenerInterface> ack_listener);
 
+  // Same as WritevData except data is provided in reference counted memory so
+  // that data copy is avoided.
+  QuicConsumedData WriteMemSlices(QuicMemSliceSpan span, bool fin);
+
   // Allows override of the session level writev, for the force HOL
   // blocking experiment.
   virtual QuicConsumedData WritevDataInner(

diff --git a/net/quic/core/quic_stream_send_buffer.cc b/net/quic/core/quic_stream_send_buffer.cc
index c091ca6..e195bb3 100644
--- a/net/quic/core/quic_stream_send_buffer.cc
+++ b/net/quic/core/quic_stream_send_buffer.cc

@@ -14,15 +14,12 @@
 
 namespace net {
 
-QuicStreamDataSlice::QuicStreamDataSlice(UniqueStreamBuffer data,
-                                         QuicStreamOffset offset,
-                                         QuicByteCount data_length)
-    : data(std::move(data)),
+BufferedSlice::BufferedSlice(QuicMemSlice mem_slice, QuicStreamOffset offset)
+    : slice(std::move(mem_slice)),
       offset(offset),
-      data_length(data_length),
-      outstanding_data_length(data_length) {}
+      outstanding_data_length(slice.length()) {}
 
-QuicStreamDataSlice::~QuicStreamDataSlice() {}
+BufferedSlice::~BufferedSlice() {}
 
 QuicStreamSendBuffer::QuicStreamSendBuffer(QuicBufferAllocator* allocator)
     : stream_offset_(0), allocator_(allocator) {}
@@ -38,26 +35,39 @@
       GetQuicFlag(FLAGS_quic_send_buffer_max_data_slice_size);
   while (data_length > 0) {
     size_t slice_len = std::min(data_length, max_data_slice_size);
-    SaveStreamDataOneSlice(iov, iov_offset, slice_len);
+    QuicMemSlice slice(allocator_, slice_len);
+    QuicUtils::CopyToBuffer(iov, iov_offset, slice_len,
+                            const_cast<char*>(slice.data()));
+    SaveMemSlice(std::move(slice));
     data_length -= slice_len;
     iov_offset += slice_len;
   }
 }
 
+void QuicStreamSendBuffer::SaveMemSlice(QuicMemSlice slice) {
+  if (slice.empty()) {
+    QUIC_BUG << "Try to save empty MemSlice to send buffer.";
+    return;
+  }
+  size_t length = slice.length();
+  buffered_slices_.emplace_back(std::move(slice), stream_offset_);
+  stream_offset_ += length;
+}
+
 bool QuicStreamSendBuffer::WriteStreamData(QuicStreamOffset offset,
                                            QuicByteCount data_length,
                                            QuicDataWriter* writer) {
-  for (const QuicStreamDataSlice& slice : send_buffer_) {
+  for (const BufferedSlice& slice : buffered_slices_) {
     if (offset < slice.offset) {
       break;
     }
-    if (offset >= slice.offset + slice.data_length) {
+    if (offset >= slice.offset + slice.slice.length()) {
       continue;
     }
     QuicByteCount slice_offset = offset - slice.offset;
     QuicByteCount copy_length =
-        std::min(data_length, slice.data_length - slice_offset);
-    if (!writer->WriteBytes(slice.data.get() + slice_offset, copy_length)) {
+        std::min(data_length, slice.slice.length() - slice_offset);
+    if (!writer->WriteBytes(slice.slice.data() + slice_offset, copy_length)) {
       return false;
     }
     offset += copy_length;
@@ -69,16 +79,16 @@
 
 void QuicStreamSendBuffer::RemoveStreamFrame(QuicStreamOffset offset,
                                              QuicByteCount data_length) {
-  for (QuicStreamDataSlice& slice : send_buffer_) {
+  for (BufferedSlice& slice : buffered_slices_) {
     if (offset < slice.offset) {
       break;
     }
-    if (offset >= slice.offset + slice.data_length) {
+    if (offset >= slice.offset + slice.slice.length()) {
       continue;
     }
     QuicByteCount slice_offset = offset - slice.offset;
     QuicByteCount removing_length =
-        std::min(data_length, slice.data_length - slice_offset);
+        std::min(data_length, slice.slice.length() - slice_offset);
     slice.outstanding_data_length -= removing_length;
     offset += removing_length;
     data_length -= removing_length;
@@ -87,24 +97,14 @@
 
   // Remove data which stops waiting for acks. Please note, data can be
   // acked out of order, but send buffer is cleaned up in order.
-  while (!send_buffer_.empty() &&
-         send_buffer_.front().outstanding_data_length == 0) {
-    send_buffer_.pop_front();
+  while (!buffered_slices_.empty() &&
+         buffered_slices_.front().outstanding_data_length == 0) {
+    buffered_slices_.pop_front();
   }
 }
 
-void QuicStreamSendBuffer::SaveStreamDataOneSlice(QuicIOVector iov,
-                                                  size_t iov_offset,
-                                                  QuicByteCount data_length) {
-  DCHECK_LE(iov_offset + data_length, iov.total_length);
-  UniqueStreamBuffer buffer = NewStreamBuffer(allocator_, data_length);
-  QuicUtils::CopyToBuffer(iov, iov_offset, data_length, buffer.get());
-  send_buffer_.emplace_back(std::move(buffer), stream_offset_, data_length);
-  stream_offset_ += data_length;
-}
-
 size_t QuicStreamSendBuffer::size() const {
-  return send_buffer_.size();
+  return buffered_slices_.size();
 }
 
 }  // namespace net

diff --git a/net/quic/core/quic_stream_send_buffer.h b/net/quic/core/quic_stream_send_buffer.h
index 14e50f76..79b7c1f 100644
--- a/net/quic/core/quic_stream_send_buffer.h
+++ b/net/quic/core/quic_stream_send_buffer.h

@@ -9,6 +9,7 @@
 
 #include "net/quic/core/frames/quic_stream_frame.h"
 #include "net/quic/core/quic_iovector.h"
+#include "net/quic/platform/api/quic_mem_slice.h"
 
 namespace net {
 
@@ -18,21 +19,23 @@
 
 class QuicDataWriter;
 
-// QuicStreamDataSlice comprises information of a piece of stream data.
-struct QuicStreamDataSlice {
-  QuicStreamDataSlice(UniqueStreamBuffer data,
-                      QuicStreamOffset offset,
-                      QuicByteCount data_length);
-  QuicStreamDataSlice(const QuicStreamDataSlice& other) = delete;
-  QuicStreamDataSlice(QuicStreamDataSlice&& other) = delete;
-  ~QuicStreamDataSlice();
+// BufferedSlice comprises information of a piece of stream data stored in
+// contiguous memory space. Please note, BufferedSlice is constructed when
+// stream data is saved in send buffer and is removed when stream data is fully
+// acked. There is no usage cases that BufferedSlice needs to be either copied
+// or moved.
+struct BufferedSlice {
+  BufferedSlice(QuicMemSlice mem_slice, QuicStreamOffset offset);
+  BufferedSlice(const BufferedSlice& other) = delete;
+  BufferedSlice& operator=(const BufferedSlice& other) = delete;
+  BufferedSlice(BufferedSlice&& other) = delete;
+  BufferedSlice& operator=(BufferedSlice&& other) = delete;
+  ~BufferedSlice();
 
   // Stream data of this data slice.
-  UniqueStreamBuffer data;
+  QuicMemSlice slice;
   // Location of this data slice in the stream.
   QuicStreamOffset offset;
-  // Length of this data slice in bytes.
-  QuicByteCount data_length;
   // Length of payload which is outstanding and waiting for acks.
   QuicByteCount outstanding_data_length;
 };
@@ -53,6 +56,9 @@
                       size_t iov_offset,
                       QuicByteCount data_length);
 
+  // Save |slice| to send buffer.
+  void SaveMemSlice(QuicMemSlice slice);
+
   // Write |data_length| of data starts at |offset|.
   bool WriteStreamData(QuicStreamOffset offset,
                        QuicByteCount data_length,
@@ -69,13 +75,7 @@
 
  private:
   friend class test::QuicStreamSendBufferPeer;
-  // Save |data_length| of data starts at |iov_offset| in |iov| to one data
-  // slice which contains data in a contiguous memory space.
-  void SaveStreamDataOneSlice(QuicIOVector iov,
-                              size_t iov_offset,
-                              QuicByteCount data_length);
-
-  std::deque<QuicStreamDataSlice> send_buffer_;
+  std::deque<BufferedSlice> buffered_slices_;
 
   // Offset of next inserted byte.
   QuicStreamOffset stream_offset_;

diff --git a/net/quic/core/quic_stream_send_buffer_test.cc b/net/quic/core/quic_stream_send_buffer_test.cc
index 95d2bc0f..ada0924 100644
--- a/net/quic/core/quic_stream_send_buffer_test.cc
+++ b/net/quic/core/quic_stream_send_buffer_test.cc

@@ -28,17 +28,25 @@
   QuicStreamSendBufferTest() : send_buffer_(&allocator_) {
     EXPECT_EQ(0u, send_buffer_.size());
     string data1(1536, 'a');
-    string data2(256, 'b');
-    string data3(2048, 'c');
-    struct iovec iov[3];
+    string data2 = string(256, 'b') + string(256, 'c');
+    struct iovec iov[2];
     iov[0] = MakeIovec(QuicStringPiece(data1));
     iov[1] = MakeIovec(QuicStringPiece(data2));
-    iov[2] = MakeIovec(QuicStringPiece(data3));
-    QuicIOVector quic_iov(iov, 3, 3840);
+    QuicIOVector quic_iov(iov, 2, 3840);
+
+    QuicMemSlice slice1(&allocator_, 1024);
+    memset(const_cast<char*>(slice1.data()), 'c', 1024);
+    QuicMemSlice slice2(&allocator_, 768);
+    memset(const_cast<char*>(slice2.data()), 'c', 768);
 
     // Save all data.
     SetQuicFlag(&FLAGS_quic_send_buffer_max_data_slice_size, 1024);
-    send_buffer_.SaveStreamData(quic_iov, 0, 3840);
+    send_buffer_.SaveStreamData(quic_iov, 0, 2048);
+    send_buffer_.SaveMemSlice(std::move(slice1));
+    EXPECT_TRUE(slice1.empty());
+    send_buffer_.SaveMemSlice(std::move(slice2));
+    EXPECT_TRUE(slice2.empty());
+
     EXPECT_EQ(4u, send_buffer_.size());
   }
 

diff --git a/net/quic/core/quic_stream_test.cc b/net/quic/core/quic_stream_test.cc
index 77164b0..40d1d3c 100644
--- a/net/quic/core/quic_stream_test.cc
+++ b/net/quic/core/quic_stream_test.cc

@@ -14,6 +14,7 @@
 #include "net/quic/platform/api/quic_logging.h"
 #include "net/quic/platform/api/quic_ptr_util.h"
 #include "net/quic/platform/api/quic_test.h"
+#include "net/quic/platform/api/quic_test_mem_slice_vector.h"
 #include "net/quic/test_tools/quic_config_peer.h"
 #include "net/quic/test_tools/quic_connection_peer.h"
 #include "net/quic/test_tools/quic_flow_controller_peer.h"
@@ -56,9 +57,11 @@
 
   using QuicStream::CanWriteNewData;
   using QuicStream::WriteOrBufferData;
+  using QuicStream::WriteMemSlices;
   using QuicStream::WritevData;
   using QuicStream::CloseWriteSide;
   using QuicStream::OnClose;
+  using QuicStream::fin_buffered;
 
  private:
   string data_;
@@ -1002,6 +1005,70 @@
   EXPECT_FALSE(stream_->CanWriteNewData());
 }
 
+TEST_F(QuicStreamTest, WriteMemSlices) {
+  // Set buffered data low water mark to be 100.
+  SetQuicFlag(&FLAGS_quic_buffered_data_threshold, 100);
+  // Do not flow control block this stream.
+  set_initial_flow_control_window_bytes(500000);
+
+  Initialize(kShouldProcessData);
+  if (!session_->can_use_slices()) {
+    return;
+  }
+  char data[1024];
+  std::vector<std::pair<char*, size_t>> buffers;
+  buffers.push_back(std::make_pair(data, arraysize(data)));
+  buffers.push_back(std::make_pair(data, arraysize(data)));
+  QuicTestMemSliceVector vector1(buffers);
+  QuicTestMemSliceVector vector2(buffers);
+  QuicMemSliceSpan span1 = vector1.span();
+  QuicMemSliceSpan span2 = vector2.span();
+
+  EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _))
+      .WillOnce(Return(QuicConsumedData(100, false)));
+  // There is no buffered data before, all data should be consumed.
+  QuicConsumedData consumed = stream_->WriteMemSlices(span1, false);
+  EXPECT_EQ(2048u, consumed.bytes_consumed);
+  EXPECT_FALSE(consumed.fin_consumed);
+  EXPECT_EQ(2 * arraysize(data) - 100, stream_->queued_data_bytes());
+  EXPECT_FALSE(stream_->fin_buffered());
+
+  EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _)).Times(0);
+  // No Data can be consumed as buffered data is beyond upper limit.
+  consumed = stream_->WriteMemSlices(span2, true);
+  EXPECT_EQ(0u, consumed.bytes_consumed);
+  EXPECT_FALSE(consumed.fin_consumed);
+  EXPECT_EQ(2 * arraysize(data) - 100, stream_->queued_data_bytes());
+  EXPECT_FALSE(stream_->fin_buffered());
+
+  EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _))
+      .WillOnce(Return(QuicConsumedData(
+          2 * arraysize(data) - 100 -
+              GetQuicFlag(FLAGS_quic_buffered_data_threshold) + 1,
+          false)));
+  EXPECT_CALL(*stream_, OnCanWriteNewData()).Times(1);
+  stream_->OnCanWrite();
+  EXPECT_EQ(GetQuicFlag(FLAGS_quic_buffered_data_threshold) - 1,
+            stream_->queued_data_bytes());
+  // Try to write slices2 again.
+  EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _)).Times(0);
+  consumed = stream_->WriteMemSlices(span2, true);
+  EXPECT_EQ(2048u, consumed.bytes_consumed);
+  EXPECT_TRUE(consumed.fin_consumed);
+  EXPECT_EQ(
+      2 * arraysize(data) + GetQuicFlag(FLAGS_quic_buffered_data_threshold) - 1,
+      stream_->queued_data_bytes());
+  EXPECT_TRUE(stream_->fin_buffered());
+
+  // Flush all buffered data.
+  EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _))
+      .WillOnce(Invoke(MockQuicSession::ConsumeAllData));
+  stream_->OnCanWrite();
+  EXPECT_CALL(*stream_, OnCanWriteNewData()).Times(0);
+  EXPECT_FALSE(stream_->HasBufferedData());
+  EXPECT_TRUE(stream_->write_side_closed());
+}
+
 }  // namespace
 }  // namespace test
 }  // namespace net

diff --git a/net/quic/platform/api/quic_mem_slice.h b/net/quic/platform/api/quic_mem_slice.h
new file mode 100644
index 0000000..11205af5
--- /dev/null
+++ b/net/quic/platform/api/quic_mem_slice.h

@@ -0,0 +1,57 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_PLATFORM_API_QUIC_MEM_SLICE_H_
+#define NET_QUIC_PLATFORM_API_QUIC_MEM_SLICE_H_
+
+#include "net/quic/platform/impl/quic_mem_slice_impl.h"
+
+namespace net {
+
+// QuicMemSlice is an internally reference counted data buffer used as the
+// source buffers for write operations. QuicMemSlice implicitly maintains a
+// reference count and will free the underlying data buffer when the reference
+// count reaches zero.
+class QUIC_EXPORT_PRIVATE QuicMemSlice {
+ public:
+  // Constructs a empty QuicMemSlice with no underlying data and 0 reference
+  // count.
+  QuicMemSlice() = default;
+  // Let |allocator| allocate a data buffer of |length|, then construct
+  // QuicMemSlice with reference count 1 from the allocated data buffer.
+  // Once all of the references to the allocated data buffer are released,
+  // |allocator| is responsible to free the memory. |allocator| must
+  // not be null, and |length| must not be 0. To construct an empty
+  // QuicMemSlice, use the zero-argument constructor instead.
+  QuicMemSlice(QuicBufferAllocator* allocator, size_t length)
+      : impl_(allocator, length) {}
+
+  // Constructs QuicMemSlice from |impl|. It takes the reference away from
+  // |impl|.
+  explicit QuicMemSlice(QuicMemSliceImpl impl) : impl_(std::move(impl)) {}
+
+  QuicMemSlice(const QuicMemSlice& other) = delete;
+  QuicMemSlice& operator=(const QuicMemSlice& other) = delete;
+
+  // Move constructors. |other| will not hold a reference to the data buffer
+  // after this call completes.
+  QuicMemSlice(QuicMemSlice&& other) = default;
+  QuicMemSlice& operator=(QuicMemSlice&& other) = default;
+
+  ~QuicMemSlice() = default;
+
+  // Returns a const char pointer to underlying data buffer.
+  const char* data() const { return impl_.data(); }
+  // Returns the length of underlying data buffer.
+  size_t length() const { return impl_.length(); }
+
+  bool empty() const { return impl_.empty(); }
+
+ private:
+  QuicMemSliceImpl impl_;
+};
+
+}  // namespace net
+
+#endif  // NET_QUIC_PLATFORM_API_QUIC_MEM_SLICE_H_

diff --git a/net/quic/platform/api/quic_mem_slice_span.h b/net/quic/platform/api/quic_mem_slice_span.h
new file mode 100644
index 0000000..889ed3c3
--- /dev/null
+++ b/net/quic/platform/api/quic_mem_slice_span.h

@@ -0,0 +1,45 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_PLATFORM_API_QUIC_MEM_SLICE_SPAN_H_
+#define NET_QUIC_PLATFORM_API_QUIC_MEM_SLICE_SPAN_H_
+
+#include "net/quic/platform/impl/quic_mem_slice_span_impl.h"
+
+namespace net {
+
+// QuicMemSliceSpan is effectively wrapper around an array of data structures
+// used as QuicMemSlice. So it could implemented with:
+// QuicMemSlice* slices_;
+// size_t num_slices_;
+// But for efficiency reasons, the actual implementation is an array of
+// platform-specific objects. This could avoid the translation from
+// platform-specific object to QuicMemSlice.
+// QuicMemSliceSpan does not own the underling data buffers.
+class QUIC_EXPORT_PRIVATE QuicMemSliceSpan {
+ public:
+  explicit QuicMemSliceSpan(QuicMemSliceSpanImpl impl) : impl_(impl) {}
+
+  QuicMemSliceSpan(const QuicMemSliceSpan& other) = default;
+  QuicMemSliceSpan& operator=(const QuicMemSliceSpan& other) = default;
+  QuicMemSliceSpan(QuicMemSliceSpan&& other) = default;
+  QuicMemSliceSpan& operator=(QuicMemSliceSpan&& other) = default;
+
+  ~QuicMemSliceSpan() = default;
+
+  // Save data buffers to |send_buffer| and returns the amount of saved data.
+  // |send_buffer| will hold a reference to all data buffer.
+  QuicByteCount SaveMemSlicesInSendBuffer(QuicStreamSendBuffer* send_buffer) {
+    return impl_.SaveMemSlicesInSendBuffer(send_buffer);
+  }
+
+  bool empty() const { return impl_.empty(); }
+
+ private:
+  QuicMemSliceSpanImpl impl_;
+};
+
+}  // namespace net
+
+#endif  // NET_QUIC_PLATFORM_API_QUIC_MEM_SLICE_SPAN_H_

diff --git a/net/quic/platform/api/quic_mem_slice_span_test.cc b/net/quic/platform/api/quic_mem_slice_span_test.cc
new file mode 100644
index 0000000..23464d00
--- /dev/null
+++ b/net/quic/platform/api/quic_mem_slice_span_test.cc

@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/quic/platform/api/quic_mem_slice_span.h"
+
+#include "net/quic/core/quic_simple_buffer_allocator.h"
+#include "net/quic/core/quic_stream_send_buffer.h"
+#include "net/quic/platform/api/quic_test.h"
+#include "net/quic/platform/api/quic_test_mem_slice_vector.h"
+
+namespace net {
+namespace test {
+namespace {
+
+class QuicMemSliceSpanImplTest : public QuicTest {
+ public:
+  QuicMemSliceSpanImplTest() {
+    for (size_t i = 0; i < 10; ++i) {
+      buffers_.push_back(std::make_pair(data_, 1024));
+    }
+  }
+
+  char data_[1024];
+  std::vector<std::pair<char*, size_t>> buffers_;
+};
+
+TEST_F(QuicMemSliceSpanImplTest, SaveDataInSendBuffer) {
+  SimpleBufferAllocator allocator;
+  QuicStreamSendBuffer send_buffer(&allocator);
+  QuicTestMemSliceVector vector(buffers_);
+
+  EXPECT_EQ(10 * 1024u, vector.span().SaveMemSlicesInSendBuffer(&send_buffer));
+  EXPECT_EQ(10u, send_buffer.size());
+}
+
+}  // namespace
+}  // namespace test
+}  // namespace net

diff --git a/net/quic/platform/api/quic_mem_slice_test.cc b/net/quic/platform/api/quic_mem_slice_test.cc
new file mode 100644
index 0000000..1d563af8
--- /dev/null
+++ b/net/quic/platform/api/quic_mem_slice_test.cc

@@ -0,0 +1,50 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/quic/platform/api/quic_mem_slice.h"
+
+#include "net/quic/core/quic_simple_buffer_allocator.h"
+#include "net/quic/platform/api/quic_test.h"
+
+namespace net {
+namespace test {
+namespace {
+
+class QuicMemSliceTest : public QuicTest {
+ public:
+  QuicMemSliceTest() {
+    size_t length = 1024;
+    slice_ = QuicMemSlice(&allocator_, length);
+    orig_data_ = slice_.data();
+    orig_length_ = slice_.length();
+  }
+
+  SimpleBufferAllocator allocator_;
+  QuicMemSlice slice_;
+  const char* orig_data_;
+  size_t orig_length_;
+};
+
+TEST_F(QuicMemSliceTest, MoveConstruct) {
+  QuicMemSlice moved(std::move(slice_));
+  EXPECT_EQ(moved.data(), orig_data_);
+  EXPECT_EQ(moved.length(), orig_length_);
+  EXPECT_EQ(nullptr, slice_.data());
+  EXPECT_EQ(0u, slice_.length());
+  EXPECT_TRUE(slice_.empty());
+}
+
+TEST_F(QuicMemSliceTest, MoveAssign) {
+  QuicMemSlice moved;
+  moved = std::move(slice_);
+  EXPECT_EQ(moved.data(), orig_data_);
+  EXPECT_EQ(moved.length(), orig_length_);
+  EXPECT_EQ(nullptr, slice_.data());
+  EXPECT_EQ(0u, slice_.length());
+  EXPECT_TRUE(slice_.empty());
+}
+
+}  // namespace
+}  // namespace test
+}  // namespace net

diff --git a/net/quic/platform/api/quic_test_mem_slice_vector.h b/net/quic/platform/api/quic_test_mem_slice_vector.h
new file mode 100644
index 0000000..a5bc275c
--- /dev/null
+++ b/net/quic/platform/api/quic_test_mem_slice_vector.h

@@ -0,0 +1,35 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_PLATFORM_API_QUIC_TEST_MEM_SLICE_VECTOR_H_
+#define NET_QUIC_PLATFORM_API_QUIC_TEST_MEM_SLICE_VECTOR_H_
+
+#include <utility>
+
+#include "net/quic/platform/api/quic_mem_slice_span.h"
+#include "net/quic/platform/impl/quic_test_mem_slice_vector_impl.h"
+
+namespace net {
+namespace test {
+// QuicTestMemSliceVector is a test only class which creates a vector of
+// platform-specific data structure (used as QuicMemSlice) from an array of data
+// buffers. QuicTestMemSliceVector does not own the underlying data buffer.
+// Tests using QuicTestMemSliceVector need to make sure the actual data buffers
+// outlive QuicTestMemSliceVector, and QuicTestMemSliceVector outlive the
+// returned QuicMemSliceSpan.
+class QuicTestMemSliceVector {
+ public:
+  explicit QuicTestMemSliceVector(std::vector<std::pair<char*, size_t>> buffers)
+      : impl_(std::move(buffers)) {}
+
+  QuicMemSliceSpan span() { return QuicMemSliceSpan(impl_.span()); }
+
+ private:
+  QuicTestMemSliceVectorImpl impl_;
+};
+
+}  // namespace test
+}  // namespace net
+
+#endif  // NET_QUIC_PLATFORM_API_QUIC_TEST_MEM_SLICE_VECTOR_H_

diff --git a/net/quic/platform/impl/quic_mem_slice_impl.cc b/net/quic/platform/impl/quic_mem_slice_impl.cc
new file mode 100644
index 0000000..5fdeb24a
--- /dev/null
+++ b/net/quic/platform/impl/quic_mem_slice_impl.cc

@@ -0,0 +1,44 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/quic/platform/impl/quic_mem_slice_impl.h"
+
+#include "net/quic/core/quic_buffer_allocator.h"
+
+namespace net {
+
+QuicMemSliceImpl::QuicMemSliceImpl() = default;
+
+QuicMemSliceImpl::QuicMemSliceImpl(QuicBufferAllocator* /*allocator*/,
+                                   size_t length) {
+  io_buffer_ = new IOBuffer(length);
+  length_ = length;
+}
+
+QuicMemSliceImpl::QuicMemSliceImpl(scoped_refptr<IOBuffer> io_buffer,
+                                   size_t length)
+    : io_buffer_(std::move(io_buffer)), length_(length) {}
+
+QuicMemSliceImpl::QuicMemSliceImpl(QuicMemSliceImpl&& other)
+    : io_buffer_(std::move(other.io_buffer_)), length_(other.length_) {
+  other.length_ = 0;
+}
+
+QuicMemSliceImpl& QuicMemSliceImpl::operator=(QuicMemSliceImpl&& other) {
+  io_buffer_ = std::move(other.io_buffer_);
+  length_ = other.length_;
+  other.length_ = 0;
+  return *this;
+}
+
+QuicMemSliceImpl::~QuicMemSliceImpl() = default;
+
+const char* QuicMemSliceImpl::data() const {
+  if (io_buffer_ == nullptr) {
+    return nullptr;
+  }
+  return io_buffer_->data();
+}
+
+}  // namespace net

diff --git a/net/quic/platform/impl/quic_mem_slice_impl.h b/net/quic/platform/impl/quic_mem_slice_impl.h
new file mode 100644
index 0000000..43b9aad
--- /dev/null
+++ b/net/quic/platform/impl/quic_mem_slice_impl.h

@@ -0,0 +1,52 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_PLATFORM_IMPL_QUIC_MEM_SLICE_IMPL_H_
+#define NET_QUIC_PLATFORM_IMPL_QUIC_MEM_SLICE_IMPL_H_
+
+#include "base/memory/ref_counted.h"
+#include "net/base/io_buffer.h"
+#include "net/quic/platform/api/quic_export.h"
+
+namespace net {
+
+class QuicBufferAllocator;
+
+// QuicMemSliceImpl TODO(fayang)
+class QUIC_EXPORT_PRIVATE QuicMemSliceImpl {
+ public:
+  // Constructs an empty QuicMemSliceImpl.
+  QuicMemSliceImpl();
+  // Constructs a QuicMemSliceImp by let |allocator| allocate a data buffer of
+  // |length|.
+  QuicMemSliceImpl(QuicBufferAllocator* allocator, size_t length);
+
+  QuicMemSliceImpl(scoped_refptr<IOBuffer> io_buffer, size_t length);
+
+  QuicMemSliceImpl(const QuicMemSliceImpl& other) = delete;
+  QuicMemSliceImpl& operator=(const QuicMemSliceImpl& other) = delete;
+
+  // Move constructors. |other| will not hold a reference to the data buffer
+  // after this call completes.
+  QuicMemSliceImpl(QuicMemSliceImpl&& other);
+  QuicMemSliceImpl& operator=(QuicMemSliceImpl&& other);
+
+  ~QuicMemSliceImpl();
+
+  // Returns a char pointer to underlying data buffer.
+  const char* data() const;
+  // Returns the length of underlying data buffer.
+  size_t length() const { return length_; }
+
+  bool empty() const { return length_ == 0; }
+
+ private:
+  scoped_refptr<IOBuffer> io_buffer_;
+  // Length of io_buffer_.
+  size_t length_;
+};
+
+}  // namespace net
+
+#endif  // NET_QUIC_PLATFORM_IMPL_QUIC_MEM_SLICE_IMPL_H_

diff --git a/net/quic/platform/impl/quic_mem_slice_span_impl.cc b/net/quic/platform/impl/quic_mem_slice_span_impl.cc
new file mode 100644
index 0000000..48c4816
--- /dev/null
+++ b/net/quic/platform/impl/quic_mem_slice_span_impl.cc

@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/quic/platform/impl/quic_mem_slice_span_impl.h"
+
+#include "net/quic/core/quic_stream_send_buffer.h"
+#include "net/quic/platform/api/quic_bug_tracker.h"
+
+namespace net {
+
+QuicMemSliceSpanImpl::QuicMemSliceSpanImpl(
+    const std::vector<scoped_refptr<IOBuffer>>* buffers,
+    const std::vector<size_t>* lengths)
+    : buffers_(buffers), lengths_(lengths) {
+  QUIC_BUG_IF(buffers->size() != lengths->size())
+      << " buffers size and lengths size are not equal";
+}
+
+QuicMemSliceSpanImpl::QuicMemSliceSpanImpl(const QuicMemSliceSpanImpl& other) =
+    default;
+QuicMemSliceSpanImpl& QuicMemSliceSpanImpl::operator=(
+    const QuicMemSliceSpanImpl& other) = default;
+QuicMemSliceSpanImpl::QuicMemSliceSpanImpl(QuicMemSliceSpanImpl&& other) =
+    default;
+QuicMemSliceSpanImpl& QuicMemSliceSpanImpl::operator=(
+    QuicMemSliceSpanImpl&& other) = default;
+
+QuicMemSliceSpanImpl::~QuicMemSliceSpanImpl() = default;
+
+QuicByteCount QuicMemSliceSpanImpl::SaveMemSlicesInSendBuffer(
+    QuicStreamSendBuffer* send_buffer) {
+  size_t saved_length = 0;
+  for (size_t i = 0; i < buffers_->size(); ++i) {
+    saved_length += (*lengths_)[i];
+    send_buffer->SaveMemSlice(
+        QuicMemSlice(QuicMemSliceImpl((*buffers_)[i], (*lengths_)[i])));
+  }
+  return saved_length;
+}
+
+}  // namespace net

diff --git a/net/quic/platform/impl/quic_mem_slice_span_impl.h b/net/quic/platform/impl/quic_mem_slice_span_impl.h
new file mode 100644
index 0000000..309d60f
--- /dev/null
+++ b/net/quic/platform/impl/quic_mem_slice_span_impl.h

@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_PLATFORM_IMPL_QUIC_MEM_SLICE_SPAN_IMPL_H_
+#define NET_QUIC_PLATFORM_IMPL_QUIC_MEM_SLICE_SPAN_IMPL_H_
+
+#include "base/memory/ref_counted.h"
+#include "net/base/io_buffer.h"
+#include "net/quic/core/quic_types.h"
+
+namespace net {
+
+class QuicStreamSendBuffer;
+
+// QuicMemSliceSpanImpl wraps a MemSlice span.
+class QUIC_EXPORT_PRIVATE QuicMemSliceSpanImpl {
+ public:
+  QuicMemSliceSpanImpl(const std::vector<scoped_refptr<IOBuffer>>* buffers,
+                       const std::vector<size_t>* lengths);
+
+  QuicMemSliceSpanImpl(const QuicMemSliceSpanImpl& other);
+  QuicMemSliceSpanImpl& operator=(const QuicMemSliceSpanImpl& other);
+  QuicMemSliceSpanImpl(QuicMemSliceSpanImpl&& other);
+  QuicMemSliceSpanImpl& operator=(QuicMemSliceSpanImpl&& other);
+
+  ~QuicMemSliceSpanImpl();
+
+  // Save IO buffers in buffers_ to |send_buffer| and returns the length of all
+  // saved mem slices.
+  QuicByteCount SaveMemSlicesInSendBuffer(QuicStreamSendBuffer* send_buffer);
+
+  bool empty() const { return buffers_->empty(); }
+
+ private:
+  const std::vector<scoped_refptr<IOBuffer>>* buffers_;
+  const std::vector<size_t>* lengths_;
+};
+
+}  // namespace net
+
+#endif  // NET_QUIC_PLATFORM_IMPL_QUIC_MEM_SLICE_SPAN_IMPL_H_

diff --git a/net/quic/platform/impl/quic_test_mem_slice_vector_impl.cc b/net/quic/platform/impl/quic_test_mem_slice_vector_impl.cc
new file mode 100644
index 0000000..03e650b
--- /dev/null
+++ b/net/quic/platform/impl/quic_test_mem_slice_vector_impl.cc

@@ -0,0 +1,29 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/quic/platform/impl/quic_test_mem_slice_vector_impl.h"
+
+namespace net {
+namespace test {
+
+TestIOBuffer::~TestIOBuffer() {
+  data_ = nullptr;
+}
+
+QuicTestMemSliceVectorImpl::~QuicTestMemSliceVectorImpl() {}
+
+QuicTestMemSliceVectorImpl::QuicTestMemSliceVectorImpl(
+    std::vector<std::pair<char*, size_t>> buffers) {
+  for (auto& buffer : buffers) {
+    buffers_.push_back(new TestIOBuffer(buffer.first));
+    lengths_.push_back(buffer.second);
+  }
+}
+
+QuicMemSliceSpanImpl QuicTestMemSliceVectorImpl::span() {
+  return QuicMemSliceSpanImpl(&buffers_, &lengths_);
+}
+
+}  // namespace test
+}  // namespace net

diff --git a/net/quic/platform/impl/quic_test_mem_slice_vector_impl.h b/net/quic/platform/impl/quic_test_mem_slice_vector_impl.h
new file mode 100644
index 0000000..6fa01282
--- /dev/null
+++ b/net/quic/platform/impl/quic_test_mem_slice_vector_impl.h

@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NET_QUIC_PLATFORM_IMPL_QUIC_TEST_MEM_SLICE_VECTOR_IMPL_H_
+#define NET_QUIC_PLATFORM_IMPL_QUIC_TEST_MEM_SLICE_VECTOR_IMPL_H_
+
+#include "net/quic/platform/impl/quic_mem_slice_span_impl.h"
+
+namespace net {
+
+namespace test {
+
+class TestIOBuffer : public IOBuffer {
+ public:
+  explicit TestIOBuffer(char* data) : IOBuffer(data) {}
+
+ private:
+  ~TestIOBuffer() override;
+};
+
+class QuicTestMemSliceVectorImpl {
+ public:
+  explicit QuicTestMemSliceVectorImpl(
+      std::vector<std::pair<char*, size_t>> buffers);
+  ~QuicTestMemSliceVectorImpl();
+
+  QuicMemSliceSpanImpl span();
+
+ private:
+  std::vector<scoped_refptr<IOBuffer>> buffers_;
+  std::vector<size_t> lengths_;
+};
+
+}  // namespace test
+
+}  // namespace net
+
+#endif  // NET_QUIC_PLATFORM_IMPL_QUIC_TEST_MEM_SLICE_VECTOR_IMPL_H_

diff --git a/net/socket/socket_test_util.cc b/net/socket/socket_test_util.cc
index 5f80103..51581dfc 100644
--- a/net/socket/socket_test_util.cc
+++ b/net/socket/socket_test_util.cc

@@ -306,7 +306,7 @@
   SSLConnectionStatusSetVersion(SSL_CONNECTION_VERSION_TLS1_2,
                                 &connection_status);
   // Set to TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
-  SSLConnectionStatusSetCipherSuite(0xcc14, &connection_status);
+  SSLConnectionStatusSetCipherSuite(0xcca9, &connection_status);
 }
 
 SSLSocketDataProvider::SSLSocketDataProvider(

diff --git a/net/ssl/ssl_cipher_suite_names.cc b/net/ssl/ssl_cipher_suite_names.cc
index 320c22e..9436602 100644
--- a/net/ssl/ssl_cipher_suite_names.cc
+++ b/net/ssl/ssl_cipher_suite_names.cc

@@ -4,357 +4,47 @@
 
 #include "net/ssl/ssl_cipher_suite_names.h"
 
-#include <stdlib.h>
-
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "net/ssl/ssl_connection_status_flags.h"
 #include "third_party/boringssl/src/include/openssl/ssl.h"
 
-// Rather than storing the names of all the ciphersuites we eliminate the
-// redundancy and break each cipher suite into a key exchange method, cipher
-// and mac. For all the ciphersuites in the IANA registry, we extract each of
-// those components from the name, number them and pack the result into a
-// 16-bit number thus:
-//   (MSB to LSB)
-//   <3 bits> unused
-//   <5 bits> key exchange
-//   <5 bits> cipher
-//   <3 bits> mac
-
-// The following tables were generated by ssl_cipher_suite_names_generate.go,
-// found in the same directory as this file.
+namespace net {
 
 namespace {
 
-struct CipherSuite {
-  uint16_t cipher_suite, encoded;
-};
-
-const struct CipherSuite kCipherSuites[] = {
-    {0x0, 0x0},        // TLS_NULL_WITH_NULL_NULL
-    {0x1, 0x101},      // TLS_RSA_WITH_NULL_MD5
-    {0x2, 0x102},      // TLS_RSA_WITH_NULL_SHA
-    {0x3, 0x209},      // TLS_RSA_EXPORT_WITH_RC4_40_MD5
-    {0x4, 0x111},      // TLS_RSA_WITH_RC4_128_MD5
-    {0x5, 0x112},      // TLS_RSA_WITH_RC4_128_SHA
-    {0x6, 0x219},      // TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
-    {0x7, 0x122},      // TLS_RSA_WITH_IDEA_CBC_SHA
-    {0x8, 0x22a},      // TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
-    {0x9, 0x132},      // TLS_RSA_WITH_DES_CBC_SHA
-    {0xa, 0x13a},      // TLS_RSA_WITH_3DES_EDE_CBC_SHA
-    {0xb, 0x32a},      // TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA
-    {0xc, 0x432},      // TLS_DH_DSS_WITH_DES_CBC_SHA
-    {0xd, 0x43a},      // TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
-    {0xe, 0x52a},      // TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA
-    {0xf, 0x632},      // TLS_DH_RSA_WITH_DES_CBC_SHA
-    {0x10, 0x63a},     // TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA
-    {0x11, 0x72a},     // TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
-    {0x12, 0x832},     // TLS_DHE_DSS_WITH_DES_CBC_SHA
-    {0x13, 0x83a},     // TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
-    {0x14, 0x92a},     // TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
-    {0x15, 0xa32},     // TLS_DHE_RSA_WITH_DES_CBC_SHA
-    {0x16, 0xa3a},     // TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
-    {0x17, 0xb09},     // TLS_DH_anon_EXPORT_WITH_RC4_40_MD5
-    {0x18, 0xc11},     // TLS_DH_anon_WITH_RC4_128_MD5
-    {0x19, 0xb2a},     // TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
-    {0x1a, 0xc32},     // TLS_DH_anon_WITH_DES_CBC_SHA
-    {0x1b, 0xc3a},     // TLS_DH_anon_WITH_3DES_EDE_CBC_SHA
-    {0x2f, 0x142},     // TLS_RSA_WITH_AES_128_CBC_SHA
-    {0x30, 0x442},     // TLS_DH_DSS_WITH_AES_128_CBC_SHA
-    {0x31, 0x642},     // TLS_DH_RSA_WITH_AES_128_CBC_SHA
-    {0x32, 0x842},     // TLS_DHE_DSS_WITH_AES_128_CBC_SHA
-    {0x33, 0xa42},     // TLS_DHE_RSA_WITH_AES_128_CBC_SHA
-    {0x34, 0xc42},     // TLS_DH_anon_WITH_AES_128_CBC_SHA
-    {0x35, 0x14a},     // TLS_RSA_WITH_AES_256_CBC_SHA
-    {0x36, 0x44a},     // TLS_DH_DSS_WITH_AES_256_CBC_SHA
-    {0x37, 0x64a},     // TLS_DH_RSA_WITH_AES_256_CBC_SHA
-    {0x38, 0x84a},     // TLS_DHE_DSS_WITH_AES_256_CBC_SHA
-    {0x39, 0xa4a},     // TLS_DHE_RSA_WITH_AES_256_CBC_SHA
-    {0x3a, 0xc4a},     // TLS_DH_anon_WITH_AES_256_CBC_SHA
-    {0x3b, 0x103},     // TLS_RSA_WITH_NULL_SHA256
-    {0x3c, 0x143},     // TLS_RSA_WITH_AES_128_CBC_SHA256
-    {0x3d, 0x14b},     // TLS_RSA_WITH_AES_256_CBC_SHA256
-    {0x3e, 0x443},     // TLS_DH_DSS_WITH_AES_128_CBC_SHA256
-    {0x3f, 0x643},     // TLS_DH_RSA_WITH_AES_128_CBC_SHA256
-    {0x40, 0x843},     // TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
-    {0x41, 0x152},     // TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
-    {0x42, 0x452},     // TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA
-    {0x43, 0x652},     // TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA
-    {0x44, 0x852},     // TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
-    {0x45, 0xa52},     // TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
-    {0x46, 0xc52},     // TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA
-    {0x67, 0xa43},     // TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
-    {0x68, 0x44b},     // TLS_DH_DSS_WITH_AES_256_CBC_SHA256
-    {0x69, 0x64b},     // TLS_DH_RSA_WITH_AES_256_CBC_SHA256
-    {0x6a, 0x84b},     // TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
-    {0x6b, 0xa4b},     // TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
-    {0x6c, 0xc43},     // TLS_DH_anon_WITH_AES_128_CBC_SHA256
-    {0x6d, 0xc4b},     // TLS_DH_anon_WITH_AES_256_CBC_SHA256
-    {0x84, 0x15a},     // TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
-    {0x85, 0x45a},     // TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA
-    {0x86, 0x65a},     // TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA
-    {0x87, 0x85a},     // TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
-    {0x88, 0xa5a},     // TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
-    {0x89, 0xc5a},     // TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA
-    {0x96, 0x162},     // TLS_RSA_WITH_SEED_CBC_SHA
-    {0x97, 0x462},     // TLS_DH_DSS_WITH_SEED_CBC_SHA
-    {0x98, 0x662},     // TLS_DH_RSA_WITH_SEED_CBC_SHA
-    {0x99, 0x862},     // TLS_DHE_DSS_WITH_SEED_CBC_SHA
-    {0x9a, 0xa62},     // TLS_DHE_RSA_WITH_SEED_CBC_SHA
-    {0x9b, 0xc62},     // TLS_DH_anon_WITH_SEED_CBC_SHA
-    {0x9c, 0x16f},     // TLS_RSA_WITH_AES_128_GCM_SHA256
-    {0x9d, 0x177},     // TLS_RSA_WITH_AES_256_GCM_SHA384
-    {0x9e, 0xa6f},     // TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
-    {0x9f, 0xa77},     // TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
-    {0xa0, 0x66f},     // TLS_DH_RSA_WITH_AES_128_GCM_SHA256
-    {0xa1, 0x677},     // TLS_DH_RSA_WITH_AES_256_GCM_SHA384
-    {0xa2, 0x86f},     // TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
-    {0xa3, 0x877},     // TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
-    {0xa4, 0x46f},     // TLS_DH_DSS_WITH_AES_128_GCM_SHA256
-    {0xa5, 0x477},     // TLS_DH_DSS_WITH_AES_256_GCM_SHA384
-    {0xa6, 0xc6f},     // TLS_DH_anon_WITH_AES_128_GCM_SHA256
-    {0xa7, 0xc77},     // TLS_DH_anon_WITH_AES_256_GCM_SHA384
-    {0xba, 0x153},     // TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xbb, 0x453},     // TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256
-    {0xbc, 0x653},     // TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xbd, 0x853},     // TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256
-    {0xbe, 0xa53},     // TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xbf, 0xc53},     // TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256
-    {0xc0, 0x15b},     // TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
-    {0xc1, 0x45b},     // TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256
-    {0xc2, 0x65b},     // TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256
-    {0xc3, 0x85b},     // TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256
-    {0xc4, 0xa5b},     // TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
-    {0xc5, 0xc5b},     // TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256
-    {0x1301, 0x1f6f},  // TLS_AES_128_GCM_SHA256
-    {0x1302, 0x1f77},  // TLS_AES_256_GCM_SHA384
-    {0x1303, 0x1f8f},  // TLS_CHACHA20_POLY1305_SHA256
-    {0x16b7, 0x128f},  // TLS_CECPQ1_RSA_WITH_CHACHA20_POLY1305_SHA256 (exper)
-    {0x16b8, 0x138f},  // TLS_CECPQ1_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (exper)
-    {0x16b9, 0x1277},  // TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384 (exper)
-    {0x16ba, 0x1377},  // TLS_CECPQ1_ECDSA_WITH_AES_256_GCM_SHA384 (exper)
-    {0xc001, 0xd02},   // TLS_ECDH_ECDSA_WITH_NULL_SHA
-    {0xc002, 0xd12},   // TLS_ECDH_ECDSA_WITH_RC4_128_SHA
-    {0xc003, 0xd3a},   // TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
-    {0xc004, 0xd42},   // TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
-    {0xc005, 0xd4a},   // TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
-    {0xc006, 0xe02},   // TLS_ECDHE_ECDSA_WITH_NULL_SHA
-    {0xc007, 0xe12},   // TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
-    {0xc008, 0xe3a},   // TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
-    {0xc009, 0xe42},   // TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
-    {0xc00a, 0xe4a},   // TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
-    {0xc00b, 0xf02},   // TLS_ECDH_RSA_WITH_NULL_SHA
-    {0xc00c, 0xf12},   // TLS_ECDH_RSA_WITH_RC4_128_SHA
-    {0xc00d, 0xf3a},   // TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
-    {0xc00e, 0xf42},   // TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
-    {0xc00f, 0xf4a},   // TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
-    {0xc010, 0x1002},  // TLS_ECDHE_RSA_WITH_NULL_SHA
-    {0xc011, 0x1012},  // TLS_ECDHE_RSA_WITH_RC4_128_SHA
-    {0xc012, 0x103a},  // TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
-    {0xc013, 0x1042},  // TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
-    {0xc014, 0x104a},  // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
-    {0xc015, 0x1102},  // TLS_ECDH_anon_WITH_NULL_SHA
-    {0xc016, 0x1112},  // TLS_ECDH_anon_WITH_RC4_128_SHA
-    {0xc017, 0x113a},  // TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
-    {0xc018, 0x1142},  // TLS_ECDH_anon_WITH_AES_128_CBC_SHA
-    {0xc019, 0x114a},  // TLS_ECDH_anon_WITH_AES_256_CBC_SHA
-    {0xc023, 0xe43},   // TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
-    {0xc024, 0xe4c},   // TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
-    {0xc025, 0xd43},   // TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
-    {0xc026, 0xd4c},   // TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
-    {0xc027, 0x1043},  // TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
-    {0xc028, 0x104c},  // TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
-    {0xc029, 0xf43},   // TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
-    {0xc02a, 0xf4c},   // TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
-    {0xc02b, 0xe6f},   // TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
-    {0xc02c, 0xe77},   // TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-    {0xc02d, 0xd6f},   // TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
-    {0xc02e, 0xd77},   // TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
-    {0xc02f, 0x106f},  // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
-    {0xc030, 0x1077},  // TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
-    {0xc031, 0xf6f},   // TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
-    {0xc032, 0xf77},   // TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
-    {0xc072, 0xe53},   // TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xc073, 0xe5c},   // TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
-    {0xc074, 0xd53},   // TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xc075, 0xd5c},   // TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
-    {0xc076, 0x1053},  // TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xc077, 0x105c},  // TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
-    {0xc078, 0xf53},   // TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
-    {0xc079, 0xf5c},   // TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
-    {0xc07a, 0x17f},   // TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc07b, 0x187},   // TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc07c, 0xa7f},   // TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc07d, 0xa87},   // TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc07e, 0x67f},   // TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc07f, 0x687},   // TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc080, 0x87f},   // TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc081, 0x887},   // TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc082, 0x47f},   // TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc083, 0x487},   // TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc084, 0xc7f},   // TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc085, 0xc87},   // TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc086, 0xe7f},   // TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc087, 0xe87},   // TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc088, 0xd7f},   // TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc089, 0xd87},   // TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc08a, 0x107f},  // TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc08b, 0x1087},  // TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xc08c, 0xf7f},   // TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
-    {0xc08d, 0xf87},   // TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
-    {0xcc13, 0x108f},  // TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 (non-standard)
-    {0xcc14, 0x0e8f},  // TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 (non-standard)
-    {0xcca8, 0x108f},  // TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-    {0xcca9, 0x0e8f},  // TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
-};
-
-const struct {
-  char name[15];
-} kKeyExchangeNames[20] = {
-    {"NULL"},            // 0
-    {"RSA"},             // 1
-    {"RSA_EXPORT"},      // 2
-    {"DH_DSS_EXPORT"},   // 3
-    {"DH_DSS"},          // 4
-    {"DH_RSA_EXPORT"},   // 5
-    {"DH_RSA"},          // 6
-    {"DHE_DSS_EXPORT"},  // 7
-    {"DHE_DSS"},         // 8
-    {"DHE_RSA_EXPORT"},  // 9
-    {"DHE_RSA"},         // 10
-    {"DH_anon_EXPORT"},  // 11
-    {"DH_anon"},         // 12
-    {"ECDH_ECDSA"},      // 13
-    {"ECDHE_ECDSA"},     // 14
-    {"ECDH_RSA"},        // 15
-    {"ECDHE_RSA"},       // 16
-    {"ECDH_anon"},       // 17
-    {"CECPQ1_RSA"},      // 18
-    {"CECPQ1_ECDSA"},    // 19
-    // 31 is reserved to indicate a TLS 1.3 AEAD-only suite.
-};
-
-constexpr int kTLS13KeyExchangeValue = 31;
-
-const struct {
-  char name[18];
-} kCipherNames[18] = {
-  {"NULL"},  // 0
-  {"RC4_40"},  // 1
-  {"RC4_128"},  // 2
-  {"RC2_CBC_40"},  // 3
-  {"IDEA_CBC"},  // 4
-  {"DES40_CBC"},  // 5
-  {"DES_CBC"},  // 6
-  {"3DES_EDE_CBC"},  // 7
-  {"AES_128_CBC"},  // 8
-  {"AES_256_CBC"},  // 9
-  {"CAMELLIA_128_CBC"},  // 10
-  {"CAMELLIA_256_CBC"},  // 11
-  {"SEED_CBC"},  // 12
-  {"AES_128_GCM"},  // 13
-  {"AES_256_GCM"},  // 14
-  {"CAMELLIA_128_GCM"},  // 15
-  {"CAMELLIA_256_GCM"},  // 16
-  {"CHACHA20_POLY1305"},  // 17
-};
-
-const struct {
-  char name[12];
-} kMacNames[5] = {
-  {"NULL"},  // 0
-  {"HMAC-MD5"},  // 1
-  {"HMAC-SHA1"},  // 2
-  {"HMAC-SHA256"},  // 3
-  {"HMAC-SHA384"},  // 4
-  // 7 is reserved to indicate an AEAD cipher suite.
-};
-
-const int kAEADMACValue = 7;
-
-int CipherSuiteCmp(const void* ia, const void* ib) {
-  const CipherSuite* a = static_cast<const CipherSuite*>(ia);
-  const CipherSuite* b = static_cast<const CipherSuite*>(ib);
-
-  if (a->cipher_suite < b->cipher_suite) {
-    return -1;
-  } else if (a->cipher_suite == b->cipher_suite) {
-    return 0;
-  } else {
-    return 1;
-  }
-}
-
-bool GetCipherProperties(uint16_t cipher_suite,
-                         int* out_key_exchange,
-                         int* out_cipher,
-                         int* out_mac) {
-  CipherSuite desired = {0};
-  desired.cipher_suite = cipher_suite;
-  void* r = bsearch(&desired, kCipherSuites, arraysize(kCipherSuites),
-                    sizeof(kCipherSuites[0]), CipherSuiteCmp);
-
-  if (!r)
-    return false;
-
-  const CipherSuite* cs = static_cast<const CipherSuite*>(r);
-  *out_key_exchange = cs->encoded >> 8;
-  *out_cipher = (cs->encoded >> 3) & 0x1f;
-  *out_mac = cs->encoded & 0x7;
-  return true;
-}
-
 int ObsoleteSSLStatusForProtocol(int ssl_version) {
-  int obsolete_ssl = net::OBSOLETE_SSL_NONE;
-  if (ssl_version < net::SSL_CONNECTION_VERSION_TLS1_2)
-    obsolete_ssl |= net::OBSOLETE_SSL_MASK_PROTOCOL;
+  int obsolete_ssl = OBSOLETE_SSL_NONE;
+  if (ssl_version < SSL_CONNECTION_VERSION_TLS1_2)
+    obsolete_ssl |= OBSOLETE_SSL_MASK_PROTOCOL;
   return obsolete_ssl;
 }
 
 int ObsoleteSSLStatusForCipherSuite(uint16_t cipher_suite) {
-  int obsolete_ssl = net::OBSOLETE_SSL_NONE;
+  int obsolete_ssl = OBSOLETE_SSL_NONE;
 
-  int key_exchange, cipher, mac;
-  if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac)) {
+  const SSL_CIPHER* cipher = SSL_get_cipher_by_value(cipher_suite);
+  if (!cipher) {
     // Cannot determine/unknown cipher suite. Err on the side of caution.
-    obsolete_ssl |= net::OBSOLETE_SSL_MASK_KEY_EXCHANGE;
-    obsolete_ssl |= net::OBSOLETE_SSL_MASK_CIPHER;
+    obsolete_ssl |= OBSOLETE_SSL_MASK_KEY_EXCHANGE;
+    obsolete_ssl |= OBSOLETE_SSL_MASK_CIPHER;
     return obsolete_ssl;
   }
 
-  switch (key_exchange) {
-    case 14:  // ECDHE_ECDSA
-    case 16:  // ECDHE_RSA
-    case 18:  // CECPQ1_RSA
-    case 19:  // CECPQ1_ECDSA
-    case kTLS13KeyExchangeValue:  // TLS 1.3
-      break;
-    default:
-      obsolete_ssl |= net::OBSOLETE_SSL_MASK_KEY_EXCHANGE;
+  if (SSL_CIPHER_get_kx_nid(cipher) == NID_kx_rsa) {
+    obsolete_ssl |= OBSOLETE_SSL_MASK_KEY_EXCHANGE;
   }
 
-  switch (cipher) {
-    case 13:  // AES_128_GCM
-    case 14:  // AES_256_GCM
-    case 17:  // CHACHA20_POLY1305
-      break;
-    default:
-      obsolete_ssl |= net::OBSOLETE_SSL_MASK_CIPHER;
+  if (!SSL_CIPHER_is_aead(cipher)) {
+    obsolete_ssl |= OBSOLETE_SSL_MASK_CIPHER;
   }
 
-  // Only AEADs allowed.
-  if (mac != kAEADMACValue)
-    obsolete_ssl |= net::OBSOLETE_SSL_MASK_CIPHER;
-
   return obsolete_ssl;
 }
 
 }  // namespace
 
-namespace net {
-
 void SSLCipherSuiteToStrings(const char** key_exchange_str,
                              const char** cipher_str,
                              const char** mac_str,
@@ -365,22 +55,66 @@
   *is_aead = false;
   *is_tls13 = false;
 
-  int key_exchange, cipher, mac;
-  if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac))
+  const SSL_CIPHER* cipher = SSL_get_cipher_by_value(cipher_suite);
+  if (!cipher)
     return;
 
-  if (key_exchange == kTLS13KeyExchangeValue) {
-    *key_exchange_str = nullptr;
-    *is_tls13 = true;
-  } else {
-    *key_exchange_str = kKeyExchangeNames[key_exchange].name;
+  switch (SSL_CIPHER_get_kx_nid(cipher)) {
+    case NID_kx_any:
+      *key_exchange_str = nullptr;
+      *is_tls13 = true;
+      break;
+    case NID_kx_rsa:
+      *key_exchange_str = "RSA";
+      break;
+    case NID_kx_ecdhe:
+      switch (SSL_CIPHER_get_auth_nid(cipher)) {
+        case NID_auth_rsa:
+          *key_exchange_str = "ECDHE_RSA";
+          break;
+        case NID_auth_ecdsa:
+          *key_exchange_str = "ECDHE_ECDSA";
+          break;
+      }
+      break;
   }
-  *cipher_str = kCipherNames[cipher].name;
-  if (mac == kAEADMACValue) {
+
+  switch (SSL_CIPHER_get_cipher_nid(cipher)) {
+    case NID_aes_128_gcm:
+      *cipher_str = "AES_128_GCM";
+      break;
+    case NID_aes_256_gcm:
+      *cipher_str = "AES_256_GCM";
+      break;
+    case NID_chacha20_poly1305:
+      *cipher_str = "CHACHA20_POLY1305";
+      break;
+    case NID_aes_128_cbc:
+      *cipher_str = "AES_128_CBC";
+      break;
+    case NID_aes_256_cbc:
+      *cipher_str = "AES_256_CBC";
+      break;
+    case NID_des_ede3_cbc:
+      *cipher_str = "3DES_EDE_CBC";
+      break;
+  }
+
+  if (SSL_CIPHER_is_aead(cipher)) {
     *is_aead = true;
     *mac_str = nullptr;
   } else {
-    *mac_str = kMacNames[mac].name;
+    switch (SSL_CIPHER_get_digest_nid(cipher)) {
+      case NID_sha1:
+        *mac_str = "HMAC-SHA1";
+        break;
+      case NID_sha256:
+        *mac_str = "HMAC-SHA256";
+        break;
+      case NID_sha384:
+        *mac_str = "HMAC-SHA384";
+        break;
+    }
   }
 }
 
@@ -440,37 +174,7 @@
 }
 
 bool IsTLSCipherSuiteAllowedByHTTP2(uint16_t cipher_suite) {
-  int key_exchange, cipher, mac;
-  if (!GetCipherProperties(cipher_suite, &key_exchange, &cipher, &mac))
-    return false;
-
-  // Only allow forward secure key exchanges.
-  switch (key_exchange) {
-    case 10:  // DHE_RSA
-    case 14:  // ECDHE_ECDSA
-    case 16:  // ECDHE_RSA
-    case 18:  // CECPQ1_RSA
-    case 19:  // CECPQ1_ECDSA
-    case kTLS13KeyExchangeValue:  // TLS 1.3
-      break;
-    default:
-      return false;
-  }
-
-  switch (cipher) {
-    case 13:  // AES_128_GCM
-    case 14:  // AES_256_GCM
-    case 17:  // CHACHA20_POLY1305
-      break;
-    default:
-      return false;
-  }
-
-  // Only AEADs allowed.
-  if (mac != kAEADMACValue)
-    return false;
-
-  return true;
+  return ObsoleteSSLStatusForCipherSuite(cipher_suite) == OBSOLETE_SSL_NONE;
 }
 
 }  // namespace net

diff --git a/net/ssl/ssl_cipher_suite_names_unittest.cc b/net/ssl/ssl_cipher_suite_names_unittest.cc
index 5bda4c7..54f48a39d 100644
--- a/net/ssl/ssl_cipher_suite_names_unittest.cc
+++ b/net/ssl/ssl_cipher_suite_names_unittest.cc

@@ -20,11 +20,11 @@
     0xc02f; /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
 
 uint16_t kObsoleteCipherObsoleteKeyExchange =
-    0x67; /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 */
+    0x2f; /* TLS_RSA_WITH_AES_128_CBC_SHA */
 uint16_t kObsoleteCipherModernKeyExchange =
-    0x9e; /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */
-uint16_t kModernCipherObsoleteKeyExchange =
     0xc014; /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */
+uint16_t kModernCipherObsoleteKeyExchange =
+    0x9c; /* TLS_RSA_WITH_AES_128_GCM_SHA256 */
 uint16_t kModernCipherModernKeyExchange =
     0xc02f; /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */
 
@@ -42,16 +42,24 @@
   bool is_aead, is_tls13;
 
   SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0xc001);
-  EXPECT_STREQ("ECDH_ECDSA", key_exchange);
-  EXPECT_STREQ("NULL", cipher);
+                          0x000a);
+  EXPECT_STREQ("RSA", key_exchange);
+  EXPECT_STREQ("3DES_EDE_CBC", cipher);
   EXPECT_STREQ("HMAC-SHA1", mac);
   EXPECT_FALSE(is_aead);
   EXPECT_FALSE(is_tls13);
 
   SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0x009f);
-  EXPECT_STREQ("DHE_RSA", key_exchange);
+                          0x002f);
+  EXPECT_STREQ("RSA", key_exchange);
+  EXPECT_STREQ("AES_128_CBC", cipher);
+  EXPECT_STREQ("HMAC-SHA1", mac);
+  EXPECT_FALSE(is_aead);
+  EXPECT_FALSE(is_tls13);
+
+  SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
+                          0xc030);
+  EXPECT_STREQ("ECDHE_RSA", key_exchange);
   EXPECT_STREQ("AES_256_GCM", cipher);
   EXPECT_TRUE(is_aead);
   EXPECT_FALSE(is_tls13);
@@ -65,15 +73,6 @@
   EXPECT_FALSE(is_tls13);
   EXPECT_EQ(nullptr, mac);
 
-  // Non-standard variant.
-  SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0xcc14);
-  EXPECT_STREQ("ECDHE_ECDSA", key_exchange);
-  EXPECT_STREQ("CHACHA20_POLY1305", cipher);
-  EXPECT_TRUE(is_aead);
-  EXPECT_FALSE(is_tls13);
-  EXPECT_EQ(nullptr, mac);
-
   SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
                           0xff31);
   EXPECT_STREQ("???", key_exchange);
@@ -162,10 +161,10 @@
                 kObsoleteVersion, kObsoleteCipherObsoleteKeyExchange)));
   EXPECT_EQ(OBSOLETE_SSL_MASK_PROTOCOL | OBSOLETE_SSL_MASK_KEY_EXCHANGE,
             ObsoleteSSLStatus(MakeConnectionStatus(
-                kObsoleteVersion, kObsoleteCipherModernKeyExchange)));
+                kObsoleteVersion, kModernCipherObsoleteKeyExchange)));
   EXPECT_EQ(OBSOLETE_SSL_MASK_PROTOCOL | OBSOLETE_SSL_MASK_CIPHER,
             ObsoleteSSLStatus(MakeConnectionStatus(
-                kObsoleteVersion, kModernCipherObsoleteKeyExchange)));
+                kObsoleteVersion, kObsoleteCipherModernKeyExchange)));
   EXPECT_EQ(OBSOLETE_SSL_MASK_PROTOCOL,
             ObsoleteSSLStatus(MakeConnectionStatus(
                 kObsoleteVersion, kModernCipherModernKeyExchange)));
@@ -174,10 +173,10 @@
                 kModernVersion, kObsoleteCipherObsoleteKeyExchange)));
   EXPECT_EQ(OBSOLETE_SSL_MASK_KEY_EXCHANGE,
             ObsoleteSSLStatus(MakeConnectionStatus(
-                kModernVersion, kObsoleteCipherModernKeyExchange)));
+                kModernVersion, kModernCipherObsoleteKeyExchange)));
   EXPECT_EQ(OBSOLETE_SSL_MASK_CIPHER,
             ObsoleteSSLStatus(MakeConnectionStatus(
-                kModernVersion, kModernCipherObsoleteKeyExchange)));
+                kModernVersion, kObsoleteCipherModernKeyExchange)));
   EXPECT_EQ(OBSOLETE_SSL_NONE,
             ObsoleteSSLStatus(MakeConnectionStatus(
                 kModernVersion, kModernCipherModernKeyExchange)));
@@ -191,14 +190,6 @@
   EXPECT_FALSE(
       IsTLSCipherSuiteAllowedByHTTP2(0x0 /* TLS_NULL_WITH_NULL_NULL */));
   EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
-      0x39 /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA */));
-  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
-      0xc5 /* TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256 */));
-  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
-      0xc00f /* TLS_ECDH_RSA_WITH_AES_256_CBC_SHA */));
-  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
-      0xc083 /* TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384 */));
-  EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
       0xc014 /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA */));
   EXPECT_FALSE(IsTLSCipherSuiteAllowedByHTTP2(
       0x9c /* TLS_RSA_WITH_AES_128_GCM_SHA256 */));
@@ -208,14 +199,8 @@
 
   // HTTP/2-compatible ones.
   EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
-      0x9e /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 */));
-  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
       0xc02f /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 */));
   EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
-      0xcc13 /* ECDHE_RSA_WITH_CHACHA20_POLY1305 (non-standard) */));
-  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
-      0xcc14 /* ECDHE_ECDSA_WITH_CHACHA20_POLY1305 (non-standard) */));
-  EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
       0xcca8 /* ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */));
   EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(
       0xcca9 /* ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 */));
@@ -224,52 +209,6 @@
   EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(0x1303 /* CHACHA20_POLY1305 */));
 }
 
-TEST(CipherSuiteNamesTest, CECPQ1) {
-  const std::vector<uint16_t> kCECPQ1CipherSuites = {
-      0x16b7,  // TLS_CECPQ1_RSA_WITH_CHACHA20_POLY1305_SHA256 (non-standard)
-      0x16b8,  // TLS_CECPQ1_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (non-standard)
-      0x16b9,  // TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384 (non-standard)
-      0x16ba,  // TLS_CECPQ1_ECDSA_WITH_AES_256_GCM_SHA384 (non-standard)
-  };
-  const char *key_exchange, *cipher, *mac;
-  bool is_aead, is_tls13;
-
-  for (const uint16_t cipher_suite_id : kCECPQ1CipherSuites) {
-    SCOPED_TRACE(base::StringPrintf("cipher suite %x", cipher_suite_id));
-    EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(cipher_suite_id));
-
-    int connection_status =
-        MakeConnectionStatus(kModernVersion, cipher_suite_id);
-    EXPECT_EQ(OBSOLETE_SSL_NONE, ObsoleteSSLStatus(connection_status));
-    EXPECT_TRUE(IsTLSCipherSuiteAllowedByHTTP2(cipher_suite_id));
-    SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                            cipher_suite_id);
-    EXPECT_TRUE(is_aead);
-    EXPECT_FALSE(is_tls13);
-    EXPECT_EQ(nullptr, mac);
-  }
-
-  SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0x16b7);
-  EXPECT_STREQ("CECPQ1_RSA", key_exchange);
-  EXPECT_STREQ("CHACHA20_POLY1305", cipher);
-
-  SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0x16b8);
-  EXPECT_STREQ("CECPQ1_ECDSA", key_exchange);
-  EXPECT_STREQ("CHACHA20_POLY1305", cipher);
-
-  SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0x16b9);
-  EXPECT_STREQ("CECPQ1_RSA", key_exchange);
-  EXPECT_STREQ("AES_256_GCM", cipher);
-
-  SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead, &is_tls13,
-                          0x16ba);
-  EXPECT_STREQ("CECPQ1_ECDSA", key_exchange);
-  EXPECT_STREQ("AES_256_GCM", cipher);
-}
-
 }  // anonymous namespace
 
 }  // namespace net

diff --git a/ppapi/proxy/audio_input_resource.cc b/ppapi/proxy/audio_input_resource.cc
index cca80b7..0137440 100644
--- a/ppapi/proxy/audio_input_resource.cc
+++ b/ppapi/proxy/audio_input_resource.cc

@@ -183,9 +183,17 @@
     base::SyncSocket::Handle socket_handle) {
   socket_.reset(new base::CancelableSyncSocket(socket_handle));
   shared_memory_.reset(new base::SharedMemory(shared_memory_handle, false));
-  shared_memory_size_ = shared_memory_size;
   DCHECK(!shared_memory_->memory());
 
+  // Ensure that the allocated memory is enough for the audio bus and buffer
+  // parameters. Note that there might be slightly more allocated memory as
+  // some shared memory implementations round up to the closest 2^n when
+  // allocating.
+  // Example: DCHECK_GE(8208, 8192 + 16) for |sample_frame_count_| = 2048.
+  shared_memory_size_ = media::ComputeAudioInputBufferSize(
+      kAudioInputChannels, sample_frame_count_, 1u);
+  DCHECK_GE(shared_memory_size, shared_memory_size_);
+
   // If we fail to map the shared memory into the caller's address space we
   // might as well fail here since nothing will work if this is the case.
   CHECK(shared_memory_->Map(shared_memory_size_));
@@ -196,14 +204,6 @@
   audio_bus_ = media::AudioBus::WrapMemory(
       kAudioInputChannels, sample_frame_count_, buffer->audio);
 
-  // Ensure that the size of the created audio bus matches the allocated
-  // size in shared memory.
-  // Example: DCHECK_EQ(8208 - 16, 8192) for |sample_frame_count_| = 2048.
-  const uint32_t audio_bus_size_bytes = media::AudioBus::CalculateMemorySize(
-      audio_bus_->channels(), audio_bus_->frames());
-  DCHECK_EQ(shared_memory_size_ - sizeof(media::AudioInputBufferParameters),
-            audio_bus_size_bytes);
-
   // Create an extra integer audio buffer for user audio data callbacks.
   // Data in shared memory will be copied to this buffer, after interleaving
   // and truncation, before each input callback to match the format expected

diff --git a/ppapi/proxy/audio_output_resource.cc b/ppapi/proxy/audio_output_resource.cc
index 6eeb0f0..11db78f 100644
--- a/ppapi/proxy/audio_output_resource.cc
+++ b/ppapi/proxy/audio_output_resource.cc

@@ -168,9 +168,17 @@
     base::SyncSocket::Handle socket_handle) {
   socket_.reset(new base::CancelableSyncSocket(socket_handle));
   shared_memory_.reset(new base::SharedMemory(shared_memory_handle, false));
-  shared_memory_size_ = shared_memory_size;
   DCHECK(!shared_memory_->memory());
 
+  // Ensure that the allocated memory is enough for the audio bus and buffer
+  // parameters. Note that there might be slightly more allocated memory as
+  // some shared memory implementations round up to the closest 2^n when
+  // allocating.
+  // Example: DCHECK_GE(8208, 8192 + 16) for |sample_frame_count_| = 2048.
+  shared_memory_size_ = media::ComputeAudioOutputBufferSize(
+      kAudioOutputChannels, sample_frame_count_);
+  DCHECK_GE(shared_memory_size, shared_memory_size_);
+
   // If we fail to map the shared memory into the caller's address space we
   // might as well fail here since nothing will work if this is the case.
   CHECK(shared_memory_->Map(shared_memory_size_));
@@ -181,14 +189,6 @@
   audio_bus_ = media::AudioBus::WrapMemory(kAudioOutputChannels,
                                            sample_frame_count_, buffer->audio);
 
-  // Ensure that the size of the created audio bus matches the allocated
-  // size in shared memory.
-  // Example: DCHECK_EQ(8208 - 16, 8192) for |sample_frame_count_| = 2048.
-  const uint32_t audio_bus_size_bytes = media::AudioBus::CalculateMemorySize(
-      audio_bus_->channels(), audio_bus_->frames());
-  DCHECK_EQ(shared_memory_size_ - sizeof(media::AudioOutputBufferParameters),
-            audio_bus_size_bytes);
-
   // Setup integer audio buffer for user audio data
   client_buffer_size_bytes_ = audio_bus_->frames() * audio_bus_->channels() *
                               kBitsPerAudioOutputSample / 8;

diff --git a/ppapi/proxy/interface_list.cc b/ppapi/proxy/interface_list.cc
index d14a931..cc31041 100644
--- a/ppapi/proxy/interface_list.cc
+++ b/ppapi/proxy/interface_list.cc

@@ -410,7 +410,7 @@
 }
 
 int InterfaceList::HashInterfaceName(const std::string& name) {
-  uint32_t data = base::Hash(name.c_str(), name.size());
+  uint32_t data = base::Hash(name);
   // Strip off the signed bit because UMA doesn't support negative values,
   // but takes a signed int as input.
   return static_cast<int>(data & 0x7fffffff);

diff --git a/ppapi/shared_impl/BUILD.gn b/ppapi/shared_impl/BUILD.gn
index f5ba34a5..c60f43a 100644
--- a/ppapi/shared_impl/BUILD.gn
+++ b/ppapi/shared_impl/BUILD.gn

@@ -163,12 +163,12 @@
   ]
 
   public_deps = [
+    "//base",
     "//ppapi/c",
     "//ppapi/thunk",
   ]
 
   deps = [
-    "//base",
     "//gpu/command_buffer/client",
     "//gpu/command_buffer/client:gles2_cmd_helper",
     "//gpu/command_buffer/client:gles2_implementation",

diff --git a/ppapi/shared_impl/ppb_audio_shared.cc b/ppapi/shared_impl/ppb_audio_shared.cc
index 9beed72..dafa93f 100644
--- a/ppapi/shared_impl/ppb_audio_shared.cc
+++ b/ppapi/shared_impl/ppb_audio_shared.cc

@@ -103,7 +103,9 @@
     int sample_frame_count) {
   socket_.reset(new base::CancelableSyncSocket(socket_handle));
   shared_memory_.reset(new base::SharedMemory(shared_memory_handle, false));
-  shared_memory_size_ = shared_memory_size;
+  shared_memory_size_ = media::ComputeAudioOutputBufferSize(
+      kAudioOutputChannels, sample_frame_count);
+  DCHECK_GE(shared_memory_size, shared_memory_size_);
   bytes_per_second_ =
       kAudioOutputChannels * (kBitsPerAudioOutputSample / 8) * sample_rate;
   buffer_index_ = 0;
@@ -115,10 +117,6 @@
         std::string(),
         "Failed to map shared memory for PPB_Audio_Shared.");
   } else {
-    DCHECK_EQ(shared_memory_size_,
-              sizeof(media::AudioOutputBufferParameters) +
-                  media::AudioBus::CalculateMemorySize(kAudioOutputChannels,
-                                                       sample_frame_count));
     media::AudioOutputBuffer* buffer =
         reinterpret_cast<media::AudioOutputBuffer*>(shared_memory_->memory());
     audio_bus_ = media::AudioBus::WrapMemory(kAudioOutputChannels,

diff --git a/ppapi/thunk/BUILD.gn b/ppapi/thunk/BUILD.gn
index 44ef7d05..73c7af4c 100644
--- a/ppapi/thunk/BUILD.gn
+++ b/ppapi/thunk/BUILD.gn

@@ -212,4 +212,8 @@
 
     "PPAPI_THUNK_IMPLEMENTATION",
   ]
+
+  public_deps = [
+    "//base",
+  ]
 }

diff --git a/sandbox/win/src/policy_target_test.cc b/sandbox/win/src/policy_target_test.cc
index 4fadd0dd4..5fe667a 100644
--- a/sandbox/win/src/policy_target_test.cc
+++ b/sandbox/win/src/policy_target_test.cc

@@ -378,6 +378,16 @@
   result = policy3->SetAlternateDesktop(false);
   EXPECT_EQ(SBOX_ALL_OK, result);
 
+  base::string16 policy1_desktop_name = policy1->GetAlternateDesktop();
+  base::string16 policy2_desktop_name = policy2->GetAlternateDesktop();
+
+  // Extract only the "desktop name" portion of
+  // "{winstation name}\\{desktop name}"
+  EXPECT_NE(policy1_desktop_name.substr(
+                policy1_desktop_name.find_first_of(L'\\') + 1),
+            policy2_desktop_name.substr(
+                policy2_desktop_name.find_first_of(L'\\') + 1));
+
   policy1->DestroyAlternateDesktop();
   policy2->DestroyAlternateDesktop();
   policy3->DestroyAlternateDesktop();

diff --git a/sandbox/win/src/sandbox_policy_base.cc b/sandbox/win/src/sandbox_policy_base.cc
index 2d63df5..5c75c84 100644
--- a/sandbox/win/src/sandbox_policy_base.cc
+++ b/sandbox/win/src/sandbox_policy_base.cc

@@ -116,6 +116,9 @@
 HDESK PolicyBase::alternate_desktop_local_winstation_handle_ = nullptr;
 IntegrityLevel PolicyBase::alternate_desktop_integrity_level_label_ =
     INTEGRITY_LEVEL_SYSTEM;
+IntegrityLevel
+    PolicyBase::alternate_desktop_local_winstation_integrity_level_label_ =
+        INTEGRITY_LEVEL_SYSTEM;
 
 PolicyBase::PolicyBase()
     : ref_count(1),
@@ -447,26 +450,34 @@
   // integrity label on the object is no higher than the sandboxed process's
   // integrity level. So, we lower the label on the desktop process if it's
   // not already low enough for our process.
-  if (use_alternate_desktop_ && integrity_level_ != INTEGRITY_LEVEL_LAST &&
-      alternate_desktop_integrity_level_label_ < integrity_level_) {
+  if (use_alternate_desktop_ && integrity_level_ != INTEGRITY_LEVEL_LAST) {
     // Integrity label enum is reversed (higher level is a lower value).
     static_assert(INTEGRITY_LEVEL_SYSTEM < INTEGRITY_LEVEL_UNTRUSTED,
                   "Integrity level ordering reversed.");
     HDESK desktop_handle = nullptr;
+    IntegrityLevel desktop_integrity_level_label;
     if (use_alternate_winstation_) {
       desktop_handle = alternate_desktop_handle_;
+      desktop_integrity_level_label = alternate_desktop_integrity_level_label_;
     } else {
       desktop_handle = alternate_desktop_local_winstation_handle_;
+      desktop_integrity_level_label =
+          alternate_desktop_local_winstation_integrity_level_label_;
     }
     // If the desktop_handle hasn't been created for any reason, skip this.
-    if (desktop_handle) {
+    if (desktop_handle && desktop_integrity_level_label < integrity_level_) {
       result =
           SetObjectIntegrityLabel(desktop_handle, SE_WINDOW_OBJECT, L"",
                                   GetIntegrityLevelString(integrity_level_));
       if (ERROR_SUCCESS != result)
         return SBOX_ERROR_GENERIC;
 
-      alternate_desktop_integrity_level_label_ = integrity_level_;
+      if (use_alternate_winstation_) {
+        alternate_desktop_integrity_level_label_ = integrity_level_;
+      } else {
+        alternate_desktop_local_winstation_integrity_level_label_ =
+            integrity_level_;
+      }
     }
   }
 

diff --git a/sandbox/win/src/sandbox_policy_base.h b/sandbox/win/src/sandbox_policy_base.h
index 5cf6f96..20de193 100644
--- a/sandbox/win/src/sandbox_policy_base.h
+++ b/sandbox/win/src/sandbox_policy_base.h

@@ -162,6 +162,8 @@
   static HWINSTA alternate_winstation_handle_;
   static HDESK alternate_desktop_local_winstation_handle_;
   static IntegrityLevel alternate_desktop_integrity_level_label_;
+  static IntegrityLevel
+      alternate_desktop_local_winstation_integrity_level_label_;
 
   // Contains the list of handles being shared with the target process.
   // This list contains handles other than the stderr/stdout handles which are

diff --git a/sandbox/win/src/window.cc b/sandbox/win/src/window.cc
index 9bdf50f1..c480849 100644
--- a/sandbox/win/src/window.cc
+++ b/sandbox/win/src/window.cc

@@ -31,7 +31,7 @@
   return false;
 }
 
-}
+}  // namespace
 
 namespace sandbox {
 
@@ -65,6 +65,10 @@
 ResultCode CreateAltDesktop(HWINSTA winsta, HDESK* desktop) {
   base::string16 desktop_name = L"sbox_alternate_desktop_";
 
+  if (!winsta) {
+    desktop_name += L"local_winstation_";
+  }
+
   // Append the current PID to the desktop name.
   wchar_t buffer[16];
   _snwprintf_s(buffer, sizeof(buffer) / sizeof(wchar_t), L"0x%X",

diff --git a/sandbox/win/tests/validation_tests/suite.cc b/sandbox/win/tests/validation_tests/suite.cc
index 8453021..39a9ee4 100644
--- a/sandbox/win/tests/validation_tests/suite.cc
+++ b/sandbox/win/tests/validation_tests/suite.cc

@@ -119,7 +119,6 @@
 // Tests that the permissions on the Windowstation does not allow the sandbox
 // to get to the interactive desktop or to make the sbox desktop interactive.
 TEST(ValidationSuite, TestAlternateDesktop) {
-
   TestRunner runner;
   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"EnumAlternateWinsta NULL"));
 
@@ -133,6 +132,16 @@
   EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(command));
 }
 
+// Same as TestDesktop, but uses the local winstation, instead of an alternate
+// one.
+TEST(ValidationSuite, TestAlternateDesktopLocalWinstation) {
+  TestRunner runner;
+  runner.GetPolicy()->SetAlternateDesktop(false);
+  runner.GetPolicy()->SetIntegrityLevel(INTEGRITY_LEVEL_LOW);
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"OpenInteractiveDesktop NULL"));
+  EXPECT_EQ(SBOX_TEST_DENIED, runner.RunTest(L"SwitchToSboxDesktop NULL"));
+}
+
 // Tests if the windows are correctly protected by the sandbox.
 TEST(ValidationSuite, TestWindows) {
   TestRunner runner;
@@ -162,7 +171,6 @@
 // Tests that a low-integrity process cannot open a locked-down process (due
 // to the integrity label changing after startup via SetDelayedIntegrityLevel).
 TEST(ValidationSuite, TestProcessDenyLowIntegrity) {
-
   TestRunner runner;
   TestRunner target;
 
@@ -180,7 +188,6 @@
 
 // Tests that a locked-down process cannot open a low-integrity process.
 TEST(ValidationSuite, TestProcessDenyBelowLowIntegrity) {
-
   TestRunner runner;
   TestRunner target;
 

diff --git a/services/BUILD.gn b/services/BUILD.gn
index 36ede30..cc25a7a 100644
--- a/services/BUILD.gn
+++ b/services/BUILD.gn

@@ -19,6 +19,7 @@
   # section below. If you are unsure, contact blundell@chromium.org.
   deps = [
     "//services/identity:tests",
+    "//services/network/public/cpp:tests",
   ]
 
   if (!is_ios) {

diff --git a/services/network/public/cpp/BUILD.gn b/services/network/public/cpp/BUILD.gn
index cc13936..65b5ac63 100644
--- a/services/network/public/cpp/BUILD.gn
+++ b/services/network/public/cpp/BUILD.gn

@@ -2,6 +2,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//mojo/public/tools/bindings/mojom.gni")
+
 static_library("cpp") {
   sources = [
     "net_adapters.cc",
@@ -14,3 +16,27 @@
     "//net",
   ]
 }
+
+mojom("test_interfaces") {
+  sources = [
+    "network_traits_test_service.mojom",
+  ]
+  public_deps = [
+    "//services/network/public/interfaces",
+  ]
+}
+
+source_set("tests") {
+  testonly = true
+
+  sources = [
+    "network_struct_traits_unittest.cc",
+  ]
+  deps = [
+    ":test_interfaces",
+    "//base",
+    "//mojo/public/cpp/bindings",
+    "//net",
+    "//testing/gtest",
+  ]
+}

diff --git a/services/network/public/cpp/OWNERS b/services/network/public/cpp/OWNERS
new file mode 100644
index 0000000..2c44a46
--- /dev/null
+++ b/services/network/public/cpp/OWNERS

@@ -0,0 +1,6 @@
+per-file *.mojom=set noparent
+per-file *.mojom=file://ipc/SECURITY_OWNERS
+per-file *_struct_traits*.*=set noparent
+per-file *_struct_traits*.*=file://ipc/SECURITY_OWNERS
+per-file *.typemap=set noparent
+per-file *.typemap=file://ipc/SECURITY_OWNERS

diff --git a/services/network/public/cpp/http_request_headers.typemap b/services/network/public/cpp/http_request_headers.typemap
new file mode 100644
index 0000000..90c8e67
--- /dev/null
+++ b/services/network/public/cpp/http_request_headers.typemap

@@ -0,0 +1,15 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//services/network/public/interfaces/http_request_headers.mojom"
+public_headers = [ "//net/http/http_request_headers.h" ]
+traits_headers =
+    [ "//services/network/public/cpp/http_request_headers_struct_traits.h" ]
+sources = [
+  "//services/network/public/cpp/http_request_headers_struct_traits.cc",
+]
+public_deps = [
+  "//net",
+]
+type_mappings = [ "network.mojom.HttpRequestHeaders=net::HttpRequestHeaders" ]

diff --git a/services/network/public/cpp/http_request_headers_struct_traits.cc b/services/network/public/cpp/http_request_headers_struct_traits.cc
new file mode 100644
index 0000000..5debd75
--- /dev/null
+++ b/services/network/public/cpp/http_request_headers_struct_traits.cc

@@ -0,0 +1,45 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "services/network/public/cpp/http_request_headers_struct_traits.h"
+
+#include "net/http/http_util.h"
+
+namespace mojo {
+
+// static
+bool StructTraits<network::mojom::HttpRequestHeaderKeyValuePairDataView,
+                  net::HttpRequestHeaders::HeaderKeyValuePair>::
+    Read(network::mojom::HttpRequestHeaderKeyValuePairDataView data,
+         net::HttpRequestHeaders::HeaderKeyValuePair* item) {
+  if (!data.ReadKey(&item->key))
+    return false;
+  if (!net::HttpUtil::IsValidHeaderName(item->key))
+    return false;
+  if (!data.ReadValue(&item->value))
+    return false;
+  item->value = std::string(net::HttpUtil::TrimLWS(item->value));
+  if (!net::HttpUtil::IsValidHeaderValue(item->value))
+    return false;
+  return true;
+}
+
+// static
+bool StructTraits<network::mojom::HttpRequestHeadersDataView,
+                  net::HttpRequestHeaders>::
+    Read(network::mojom::HttpRequestHeadersDataView data,
+         net::HttpRequestHeaders* headers) {
+  ArrayDataView<network::mojom::HttpRequestHeaderKeyValuePairDataView>
+      data_view;
+  data.GetHeadersDataView(&data_view);
+  for (size_t i = 0; i < data_view.size(); ++i) {
+    net::HttpRequestHeaders::HeaderKeyValuePair pair;
+    if (!data_view.Read(i, &pair))
+      return false;
+    headers->SetHeader(pair.key, pair.value);
+  }
+  return true;
+}
+
+}  // namespace mojo

diff --git a/services/network/public/cpp/http_request_headers_struct_traits.h b/services/network/public/cpp/http_request_headers_struct_traits.h
new file mode 100644
index 0000000..07b17356
--- /dev/null
+++ b/services/network/public/cpp/http_request_headers_struct_traits.h

@@ -0,0 +1,42 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_HTTP_REQUEST_HEADERS_STRUCT_TRAITS_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_HTTP_REQUEST_HEADERS_STRUCT_TRAITS_H_
+
+#include "mojo/public/cpp/bindings/struct_traits.h"
+#include "net/http/http_request_headers.h"
+#include "services/network/public/interfaces/http_request_headers.mojom.h"
+
+namespace mojo {
+
+template <>
+struct StructTraits<network::mojom::HttpRequestHeaderKeyValuePairDataView,
+                    net::HttpRequestHeaders::HeaderKeyValuePair> {
+  static const std::string& key(
+      const net::HttpRequestHeaders::HeaderKeyValuePair& item) {
+    return item.key;
+  }
+  static const std::string& value(
+      const net::HttpRequestHeaders::HeaderKeyValuePair& item) {
+    return item.value;
+  }
+  static bool Read(network::mojom::HttpRequestHeaderKeyValuePairDataView data,
+                   net::HttpRequestHeaders::HeaderKeyValuePair* item);
+};
+
+template <>
+struct StructTraits<network::mojom::HttpRequestHeadersDataView,
+                    net::HttpRequestHeaders> {
+  static net::HttpRequestHeaders::HeaderVector headers(
+      const net::HttpRequestHeaders& data) {
+    return data.GetHeaderVector();
+  }
+  static bool Read(network::mojom::HttpRequestHeadersDataView data,
+                   net::HttpRequestHeaders* headers);
+};
+
+}  // namespace mojo
+
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_HTTP_REQUEST_HEADERS_STRUCT_TRAITS_H_

diff --git a/services/network/public/cpp/network_struct_traits_unittest.cc b/services/network/public/cpp/network_struct_traits_unittest.cc
new file mode 100644
index 0000000..2acaf6c
--- /dev/null
+++ b/services/network/public/cpp/network_struct_traits_unittest.cc

@@ -0,0 +1,110 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/message_loop/message_loop.h"
+#include "base/strings/string_util.h"
+#include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/network/public/cpp/http_request_headers_struct_traits.h"
+#include "services/network/public/cpp/network_traits_test_service.mojom.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace network {
+
+namespace {
+
+class NetworkStructTraitsTest : public testing::Test,
+                                public mojom::TraitsTestService {
+ protected:
+  NetworkStructTraitsTest() = default;
+
+  mojom::TraitsTestServicePtr GetTraitsTestProxy() {
+    mojom::TraitsTestServicePtr proxy;
+    traits_test_bindings_.AddBinding(this, mojo::MakeRequest(&proxy));
+    return proxy;
+  }
+
+ private:
+  // TraitsTestService:
+  void EchoHttpRequestHeaders(
+      const net::HttpRequestHeaders& header,
+      EchoHttpRequestHeadersCallback callback) override {
+    std::move(callback).Run(header);
+  }
+
+  base::MessageLoop loop_;
+  mojo::BindingSet<TraitsTestService> traits_test_bindings_;
+  DISALLOW_COPY_AND_ASSIGN(NetworkStructTraitsTest);
+};
+
+}  // namespace
+
+TEST_F(NetworkStructTraitsTest, HttpRequestHeaders_Basic) {
+  net::HttpRequestHeaders headers;
+  net::HttpRequestHeaders output;
+  headers.SetHeader("Foo", "bar");
+  mojom::TraitsTestServicePtr proxy = GetTraitsTestProxy();
+  proxy->EchoHttpRequestHeaders(headers, &output);
+  std::string value;
+  EXPECT_TRUE(output.GetHeader("Foo", &value));
+  EXPECT_EQ("bar", value);
+  EXPECT_FALSE(output.HasHeader("Fo"));
+}
+
+TEST_F(NetworkStructTraitsTest, HttpRequestHeaders_InvalidHeaderName) {
+  // Check that non-token chars are disallowed.
+  const unsigned char invalid_name_chars[] = {
+      0x80, 0x19, '(', ')', '<', '>', '@', ',', ';', ':',
+      '\\', '"',  '/', '[', ']', '?', '=', '{', '}'};
+  for (char c : invalid_name_chars) {
+    std::string invalid_name("foo");
+    invalid_name.push_back(c);
+    net::HttpRequestHeaders header;
+    net::HttpRequestHeaders output;
+    header.SetHeaderWithoutCheckForTesting(invalid_name, "foo");
+    mojom::TraitsTestServicePtr proxy = GetTraitsTestProxy();
+    proxy->EchoHttpRequestHeaders(header, &output);
+    std::string value;
+    EXPECT_TRUE(output.IsEmpty());
+  }
+}
+
+// Test cases are copied from HttpUtilTest.IsValidHeaderValue.
+TEST_F(NetworkStructTraitsTest, HttpRequestHeaders_InvalidHeaderValue) {
+  const char* const invalid_values[] = {
+      "X-Requested-With: chrome${NUL}Sec-Unsafe: injected",
+      "X-Requested-With: chrome\r\nSec-Unsafe: injected",
+      "X-Requested-With: chrome\nSec-Unsafe: injected",
+      "X-Requested-With: chrome\rSec-Unsafe: injected",
+  };
+
+  for (const std::string& value : invalid_values) {
+    std::string replaced = value;
+    base::ReplaceSubstringsAfterOffset(&replaced, 0, "${NUL}",
+                                       std::string(1, '\0'));
+    net::HttpRequestHeaders header;
+    net::HttpRequestHeaders output;
+    header.SetHeaderWithoutCheckForTesting("Foo", replaced);
+    mojom::TraitsTestServicePtr proxy = GetTraitsTestProxy();
+    proxy->EchoHttpRequestHeaders(header, &output);
+    EXPECT_FALSE(output.HasHeader("Foo"));
+  }
+
+  // Check that all characters permitted by RFC7230 3.2.6 are allowed.
+  std::string allowed = "\t";
+  for (char c = '\x20'; c < '\x7F'; ++c) {
+    allowed.append(1, c);
+  }
+  for (int c = 0x80; c <= 0xFF; ++c) {
+    allowed.append(1, static_cast<char>(c));
+  }
+
+  net::HttpRequestHeaders header;
+  net::HttpRequestHeaders output;
+  header.SetHeaderWithoutCheckForTesting("Foo", allowed);
+  mojom::TraitsTestServicePtr proxy = GetTraitsTestProxy();
+  proxy->EchoHttpRequestHeaders(header, &output);
+  EXPECT_TRUE(output.HasHeader("Foo"));
+}
+
+}  // namespace network

diff --git a/services/network/public/cpp/network_traits_test_service.mojom b/services/network/public/cpp/network_traits_test_service.mojom
new file mode 100644
index 0000000..ab8dae7
--- /dev/null
+++ b/services/network/public/cpp/network_traits_test_service.mojom

@@ -0,0 +1,12 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module network.mojom;
+
+import "services/network/public/interfaces/http_request_headers.mojom";
+
+interface TraitsTestService {
+  [Sync]
+  EchoHttpRequestHeaders(HttpRequestHeaders headers) => (HttpRequestHeaders pass);
+};

diff --git a/services/network/public/cpp/typemaps.gni b/services/network/public/cpp/typemaps.gni
new file mode 100644
index 0000000..91ef4571
--- /dev/null
+++ b/services/network/public/cpp/typemaps.gni

@@ -0,0 +1,5 @@
+# Copyright 2016 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+typemaps = [ "//services/network/public/cpp/http_request_headers.typemap" ]

diff --git a/services/network/public/interfaces/BUILD.gn b/services/network/public/interfaces/BUILD.gn
index f89b5a8..8df1de01 100644
--- a/services/network/public/interfaces/BUILD.gn
+++ b/services/network/public/interfaces/BUILD.gn

@@ -7,5 +7,6 @@
 mojom("interfaces") {
   sources = [
     "fetch_api.mojom",
+    "http_request_headers.mojom",
   ]
 }

diff --git a/services/network/public/interfaces/http_request_headers.mojom b/services/network/public/interfaces/http_request_headers.mojom
new file mode 100644
index 0000000..5e38006
--- /dev/null
+++ b/services/network/public/interfaces/http_request_headers.mojom

@@ -0,0 +1,14 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module network.mojom;
+
+struct HttpRequestHeaderKeyValuePair {
+  string key;
+  string value;
+};
+
+struct HttpRequestHeaders {
+  array<HttpRequestHeaderKeyValuePair> headers;
+};

diff --git a/storage/browser/blob/blob_transport_request_builder_unittest.cc b/storage/browser/blob/blob_transport_request_builder_unittest.cc
index 71e0956..10f40f0 100644
--- a/storage/browser/blob/blob_transport_request_builder_unittest.cc
+++ b/storage/browser/blob/blob_transport_request_builder_unittest.cc

@@ -20,7 +20,7 @@
 void AddMemoryItem(size_t length, std::vector<DataElement>* out) {
   DataElement bytes;
   bytes.SetToBytesDescription(length);
-  out->push_back(bytes);
+  out->push_back(std::move(bytes));
 }
 
 void AddShortcutMemoryItem(size_t length, std::vector<DataElement>* out) {
@@ -29,13 +29,13 @@
   for (size_t i = 0; i < length; i++) {
     bytes.mutable_bytes()[i] = static_cast<char>(i);
   }
-  out->push_back(bytes);
+  out->push_back(std::move(bytes));
 }
 
 void AddBlobItem(std::vector<DataElement>* out) {
   DataElement blob;
   blob.SetToBlob(kFakeBlobUUID);
-  out->push_back(blob);
+  out->push_back(std::move(blob));
 }
 
 TEST(BlobAsyncTransportRequestBuilderTest, TestNoMemoryItems) {

diff --git a/storage/common/data_element.cc b/storage/common/data_element.cc
index ea11f43..c613bc0 100644
--- a/storage/common/data_element.cc
+++ b/storage/common/data_element.cc

@@ -19,10 +19,12 @@
       offset_(0),
       length_(std::numeric_limits<uint64_t>::max()) {}
 
-DataElement::DataElement(const DataElement& other) = default;
 
 DataElement::~DataElement() {}
 
+DataElement::DataElement(DataElement&& other) = default;
+DataElement& DataElement::operator=(DataElement&& other) = default;
+
 void DataElement::SetToFilePathRange(
     const base::FilePath& path,
     uint64_t offset,

diff --git a/storage/common/data_element.h b/storage/common/data_element.h
index 744cc99..0ce598b 100644
--- a/storage/common/data_element.h
+++ b/storage/common/data_element.h

@@ -40,9 +40,13 @@
   };
 
   DataElement();
-  DataElement(const DataElement& other);
   ~DataElement();
 
+  DataElement(const DataElement&) = delete;
+  void operator=(const DataElement&) = delete;
+  DataElement(DataElement&& other);
+  DataElement& operator=(DataElement&& other);
+
   Type type() const { return type_; }
   const char* bytes() const { return bytes_ ? bytes_ : buf_.data(); }
   const base::FilePath& path() const { return path_; }

diff --git a/testing/buildbot/chromium.perf.fyi.json b/testing/buildbot/chromium.perf.fyi.json
index b1612be0..925e1d7 100644
--- a/testing/buildbot/chromium.perf.fyi.json
+++ b/testing/buildbot/chromium.perf.fyi.json

@@ -758,68 +758,6 @@
         }
       },
       {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:22b1",
-              "id": "build150-b1",
-              "os": "Windows-10-10586",
-              "pool": "Chrome-perf-fyi"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:22b1",
-              "id": "build150-b1",
-              "os": "Windows-10-10586",
-              "pool": "Chrome-perf-fyi"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
         "args": [],
         "isolate_name": "cc_perftests",
         "name": "cc_perftests",
@@ -5114,68 +5052,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "1002:9874",
-              "id": "build214-b4",
-              "os": "Windows-10-10586",
-              "pool": "Chrome-perf-fyi"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "1002:9874",
-              "id": "build214-b4",
-              "os": "Windows-10-10586",
-              "pool": "Chrome-perf-fyi"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",

diff --git a/testing/buildbot/chromium.perf.json b/testing/buildbot/chromium.perf.json
index 8c5356f..5a661dd 100644
--- a/testing/buildbot/chromium.perf.json
+++ b/testing/buildbot/chromium.perf.json

@@ -691,68 +691,6 @@
         }
       },
       {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-chromium",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build14-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build14-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
         "args": [],
         "isolate_name": "cc_perftests",
         "name": "cc_perftests",
@@ -5687,68 +5625,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-chromium",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build74-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build74-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -10351,37 +10227,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-webview",
-          "--output-format=chartjson",
-          "--webview-embedder-apk=../../out/Release/apks/SystemWebViewShell.apk"
-        ],
-        "isolate_name": "telemetry_perf_webview_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_webview_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build166-b1--device7",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -13082,68 +12927,6 @@
         }
       },
       {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-chromium",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build16-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build16-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
         "args": [],
         "isolate_name": "cc_perftests",
         "name": "cc_perftests",
@@ -17799,37 +17582,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-webview",
-          "--output-format=chartjson",
-          "--webview-embedder-apk=../../out/Release/apks/SystemWebViewShell.apk"
-        ],
-        "isolate_name": "telemetry_perf_webview_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_webview_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build114-b1--device7",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -20530,68 +20282,6 @@
         }
       },
       {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-chromium",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build10-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build10-b1--device6",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
         "args": [],
         "isolate_name": "cc_perftests",
         "name": "cc_perftests",
@@ -25402,68 +25092,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=android-chromium",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build18-b1--device7",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "android_devices": "1",
-              "id": "build18-b1--device7",
-              "os": "Android",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -30443,68 +30071,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0534",
-              "id": "build151-m1",
-              "os": "Ubuntu-14.04",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0534",
-              "id": "build151-m1",
-              "os": "Ubuntu-14.04",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -34963,68 +34529,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0166",
-              "id": "build105-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0166",
-              "id": "build105-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -39482,68 +38986,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0a2e",
-              "id": "build161-m1",
-              "os": "Mac-10.12",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0a2e",
-              "id": "build161-m1",
-              "os": "Mac-10.12",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -44001,68 +43443,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:1626",
-              "id": "build126-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:1626",
-              "id": "build126-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -48520,68 +47900,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0a26",
-              "id": "build27-b1",
-              "os": "Mac-10.12",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0a26",
-              "id": "build27-b1",
-              "os": "Mac-10.12",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -53018,68 +52336,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "1002:6821",
-              "id": "build131-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "1002:6821",
-              "id": "build131-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -57537,68 +56793,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0d26",
-              "id": "build7-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:0d26",
-              "id": "build7-b1",
-              "os": "Mac-10.11",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -61932,68 +61126,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:1616",
-              "id": "build120-b1",
-              "os": "Windows-10-10240",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:1616",
-              "id": "build120-b1",
-              "os": "Windows-10-10240",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -66182,68 +65314,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0534",
-              "id": "build135-m1",
-              "os": "Windows-10-10240",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0534",
-              "id": "build135-m1",
-              "os": "Windows-10-10240",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -70474,68 +69544,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "1002:6613",
-              "id": "build104-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "1002:6613",
-              "id": "build104-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -74808,68 +73816,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:041a",
-              "id": "build167-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "8086:041a",
-              "id": "build167-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -79121,68 +78067,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "10de:104a",
-              "id": "build95-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "10de:104a",
-              "id": "build95-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -83413,68 +82297,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0532",
-              "id": "build188-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0532",
-              "id": "build188-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -87705,68 +86527,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0532",
-              "id": "build141-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0532",
-              "id": "build141-m1",
-              "os": "Windows-2008ServerR2-SP1",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",
@@ -91997,68 +90757,6 @@
       },
       {
         "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=release_x64",
-          "--output-format=chartjson"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0532",
-              "id": "build146-m1",
-              "os": "Windows-2012ServerR2-SP0",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": false,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
-          "blob_storage.blob_storage",
-          "-v",
-          "--upload-results",
-          "--browser=reference",
-          "--output-format=chartjson",
-          "--max-failures=5",
-          "--output-trace-tag=_ref"
-        ],
-        "isolate_name": "telemetry_perf_tests",
-        "name": "blob_storage.blob_storage.reference",
-        "override_compile_targets": [
-          "telemetry_perf_tests"
-        ],
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "gpu": "102b:0532",
-              "id": "build146-m1",
-              "os": "Windows-2012ServerR2-SP0",
-              "pool": "Chrome-perf"
-            }
-          ],
-          "expiration": 36000,
-          "hard_timeout": 10800,
-          "ignore_task_failure": true,
-          "io_timeout": 600,
-          "upload_test_results": false
-        }
-      },
-      {
-        "args": [
           "dromaeo.domcoreattr",
           "-v",
           "--upload-results",

diff --git a/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter b/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter
index 2bb89f1d..5faf3d254 100644
--- a/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_content_browsertests.filter

@@ -35,6 +35,7 @@
 
 # http://crbug.com/715630
 -DownloadContentTest.*
+-DragDownloadFileTest.DragDownloadFileTest_Complete
 
 # http://crbug.com/721398
 -ClearSiteDataThrottleBrowserTest.*

diff --git a/testing/libfuzzer/fuzzers/hash_fuzzer.cc b/testing/libfuzzer/fuzzers/hash_fuzzer.cc
index 70447a0..eb84938 100644
--- a/testing/libfuzzer/fuzzers/hash_fuzzer.cc
+++ b/testing/libfuzzer/fuzzers/hash_fuzzer.cc

@@ -9,6 +9,6 @@
 
 // Entry point for LibFuzzer.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  base::Hash(reinterpret_cast<const char*>(data), size);
+  base::Hash(data, size);
   return 0;
 }

diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index da228bc..33984f1 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json

@@ -711,6 +711,21 @@
             ]
         }
     ],
+    "DataReductionProxySiteBreakdown": [
+        {
+            "platforms": [
+                "android"
+            ],
+            "experiments": [
+                {
+                    "name": "Enabled",
+                    "enable_features": [
+                        "DataReductionProxySiteBreakdown"
+                    ]
+                }
+            ]
+        }
+    ],
     "DataReductionProxyUseQuic": [
         {
             "platforms": [
@@ -1485,24 +1500,6 @@
             ]
         }
     ],
-    "MojoInputMessages": [
-        {
-            "platforms": [
-                "chromeos",
-                "linux",
-                "mac",
-                "win"
-            ],
-            "experiments": [
-                {
-                    "name": "Enabled",
-                    "enable_features": [
-                        "MojoInputMessages"
-                    ]
-                }
-            ]
-        }
-    ],
     "NTPArticleSuggestions": [
         {
             "platforms": [

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index 9fff8198..bcf05ad 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG

@@ -301,6 +301,8 @@
 crbug.com/591099 compositing/contents-opaque/overflow-hidden-child-layers.html [ Failure ]
 crbug.com/591099 compositing/culling/clear-fixed-iframe.html [ Failure ]
 crbug.com/591099 compositing/direct-image-compositing.html [ Failure ]
+crbug.com/591099 compositing/draws-content/canvas-background-layer.html [ Failure ]
+crbug.com/591099 compositing/draws-content/webgl-background-layer.html [ Failure ]
 crbug.com/591099 compositing/empty-render-surface-crasher.html [ Failure ]
 crbug.com/591099 compositing/filters/sw-layer-overlaps-hw-shadow.html [ Failure Pass ]
 crbug.com/591099 compositing/filters/sw-nested-shadow-overlaps-hw-nested-shadow.html [ Failure Pass ]
@@ -10695,7 +10697,6 @@
 crbug.com/591099 fast/text/glyph-overflow.html [ Failure ]
 crbug.com/591099 fast/text/glyph-reordering.html [ Failure ]
 crbug.com/591099 fast/text/hide-atomic-inlines-after-ellipsis.html [ Crash Failure ]
-crbug.com/591099 fast/text/hyphens/hyphens-none.html [ Failure Pass ]
 crbug.com/591099 fast/text/international/arabic-justify.html [ Failure ]
 crbug.com/591099 fast/text/international/bidi-AN-after-empty-run.html [ Failure ]
 crbug.com/591099 fast/text/international/bidi-LDB-2-CSS.html [ Failure ]
@@ -13890,6 +13891,7 @@
 crbug.com/591099 media/controls/video-overlay-cast-dark-rendering.html [ Failure ]
 crbug.com/591099 media/controls/video-overlay-cast-light-rendering.html [ Failure ]
 crbug.com/591099 media/fallback.html [ Failure ]
+crbug.com/591099 media/media-document-audio-repaint.html [ Failure ]
 crbug.com/591099 media/media-document-audio-size.html [ Failure ]
 crbug.com/591099 media/network-no-source-const-shadow.html [ Failure ]
 crbug.com/591099 media/remove-from-document-config-controls-no-crash.html [ Crash Failure ]
@@ -18886,246 +18888,7 @@
 crbug.com/591099 virtual/new-remote-playback-pipeline/media/controls/video-controls-with-cast-rendering.html [ Failure ]
 crbug.com/591099 virtual/new-remote-playback-pipeline/media/controls/video-overlay-cast-dark-rendering.html [ Failure ]
 crbug.com/591099 virtual/new-remote-playback-pipeline/media/controls/video-overlay-cast-light-rendering.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/XMLHttpRequestException.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/abort-should-destroy-responseText.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-preflight-data-saver.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-preflight-headers-async.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-preflight-request-header-sorted.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-preflight-request-headers-origin.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-preflight-request-invalid-status-400.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-response-with-body-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-response-with-body.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-response-with-expose-headers.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow-origin-null.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-sandboxed-iframe-allow.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/async-xhr-revalidate-after-sync-xhr.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/authorization-header.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/binary-x-user-defined.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/bom.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/broken-xml-encoding.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/cache-control-request.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/cache-override.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/chunked-progress-event-expectedLength.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/close-window.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/connection-error-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/cookies.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/cross-origin-preflight-get-response-type-blob.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/cross-origin-preflight-get.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/cross-origin-unsupported-url.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/detaching-frame-2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/detaching-frame.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/docLoaderFrame.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/duplicate-revalidation-reload.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/encode-request-url-2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/encode-request-url.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/encoding-send-latin-1.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/event-listener-gc.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/event-target.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/exceptions.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/extra-parameters.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/failed-auth.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/filename-encoding.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/frame-load-cancelled-abort.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/frame-unload-abort-crash.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/get-dangerous-headers.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/getAllResponseHeaders.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/getResponseHeader.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/infoOnProgressEvent-response-type-blob.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/infoOnProgressEvent.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/inject-header.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/interactive-state.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/logout.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/methods-async.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/methods-lower-case.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/methods.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/newline-in-request-uri.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/null-auth.php [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/onabort-event.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/onerror-event.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/onloadend-event-after-abort.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/onloadend-event-after-error.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/onloadend-event-after-sync-requests.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/onloadstart-event.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/open-async-overload.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/open-in-body-onload-sync-to-invalid-cross-origin-response-handling.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/open-in-body-onload-sync-to-invalid-preflight-handling.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/open-in-body-onload-sync-to-invalid-redirect-response-handling.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/00.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/01.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/02.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/03.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/04.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/05.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/06.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/07.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/08.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/09.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/10.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/11.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/12.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/13.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/14.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/15.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/16.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/17.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/18.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/19.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/20.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/21.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/22.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/23.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/24.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/25.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/26.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/27.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/28.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/29.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/30.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/31.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/32.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/33.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/34.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/35.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/36.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/37.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/38.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/39.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/40.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/41.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/42.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/43.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/44.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/45.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/46.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-exact-matching/47.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-all.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-exact-match.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-https.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-removal.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-subdomains.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/post-arraybuffer-data-view.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/post-blob-content-type-async.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/post-blob-content-type-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/post-content-type.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/post-formdata.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/post-with-boundary.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/range-test.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/readystatechange.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cors-origin-null.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin-2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin-post-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin-post.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin-sync-double.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin-tripmine.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/redirect-cross-origin.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/referer.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/remember-bad-password.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/reopen-encoding.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/request-encoding.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/request-encoding2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/request-encoding3.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/request-encoding4.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/request-from-popup.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-array-buffer-abort-in-loading-state.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-blob-abort-in-loading-state.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-blob-mimetype.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-document.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-encoding.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-encoding2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/response-text.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/responsexml-type.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/send-object-tostring-check.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/serialize-document.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/set-dangerous-headers.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/simple-cross-origin-denied-events-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/simple-cross-origin-denied-events.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/simple-cross-origin-progress-events.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/state-after-network-error.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/status-after-abort.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/supported-xml-content-types-invalid-1.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/supported-xml-content-types-invalid-2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/supported-xml-content-types-strange-valid-1.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/supported-xml-content-types-strange-valid-2.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/supported-xml-content-types.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/svg-created-by-xhr-allowed-in-dashboard.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/sync-xhr-revalidate-after-async-xhr.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/upload-onloadend-event-after-abort.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/upload-onloadend-event-after-sync-requests.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/upload-onloadstart-event.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/upload-onprogress-event.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/upload-request-error-event-order.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/web-apps/007.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/web-apps/018.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/abort-exception-assert.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/access-control-preflight-request-headers-referer.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/close.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/cross-origin-unsupported-url.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/methods-async.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/methods.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/post-formdata.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/referer.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-access-control-basic-get-fail-non-simple.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-close.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-methods-async.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-methods.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-referer.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-response-type-blob-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-response-type-blob.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/upload-onprogress-event.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/xmlhttprequest-allowed-with-disabled-web-security.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/xmlhttprequest-file-not-found.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/xmlhttprequest-response-type-blob-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/xmlhttprequest-response-type-blob.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/workers/xmlhttprequest-timeout-override.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xhr-onunload.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xml-encoding.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldNotDispatchEvent.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-addEventListener-onProgress.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-allowed-with-disabled-web-security.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-big-document.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-check-get-readystate-for-404-without-body.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-check-head-readystate-for-404.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-contenttype-empty.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-crlf-getAllResponseHeader.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-forbidden-methods-exception.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-image-not-loaded.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-inheritance.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-latin1.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-mimetype-mixed-case.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-missing-file-exception.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-multiple-open.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-no-content-length-onProgress-response-type-blob.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-no-content-length-onProgress.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-no-content-type-with-text.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-no-content-type.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-onProgress-open-should-zero-length.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-open-empty-method.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-content-type-header.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-mixed-case.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-post-crash.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-response-type-blob.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-responseText-exception.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-responseXML-exception.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-name.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-value.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-sync-no-progress-events.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-sync-no-timers.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-sync-vs-async-assertion-failure.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-test-custom-headers.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-test-send-flag.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/xmlhttprequest-unload-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/zero-length-response-sync.html [ Failure ]
-crbug.com/591099 virtual/outofblink-cors/http/tests/xmlhttprequest/zero-length-response.html [ Failure ]
+crbug.com/591099 virtual/outofblink-cors/ [ Skip ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/accelerated-overflow-scroll-should-not-affect-perspective.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/accelerated-scrolling-with-clip-path-text.html [ Failure ]
 crbug.com/591099 virtual/prefer_compositing_to_lcd_text/compositing/overflow/accelerated-scrolling-with-clip-path.html [ Failure ]

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService b/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService
index ba5ccd2..8966f1d 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService

@@ -116,25 +116,7 @@
 Bug(none) fast/xsl/xslt-multiple-relative-import.xml [ Skip ]
 Bug(none) fast/xsl/xslt-nested-stylesheets.xml [ Skip ]
 Bug(none) fast/xsl/xslt-second-level-import.xml [ Skip ]
-Bug(none) http/tests/appcache/404-manifest.html [ Failure Pass ]
-Bug(none) http/tests/appcache/abort-cache-ondownloading-manifest-404.html [ Timeout ]
-Bug(none) http/tests/appcache/access-via-redirect.php [ Timeout ]
-Bug(none) http/tests/appcache/fallback.html [ Failure ]
 Bug(754827) http/tests/appcache/main-resource-redirect.html [ Timeout ]
-Bug(none) http/tests/appcache/manifest-parsing.html [ Failure ]
-Bug(none) http/tests/appcache/multi-fallback.html [ Failure Timeout ]
-Bug(none) http/tests/appcache/non-html.xhtml [ Timeout ]
-Bug(754827) http/tests/appcache/online-fallback-layering.html [ Failure ]
-Bug(none) http/tests/appcache/online-whitelist.html [ Failure ]
-Bug(none) http/tests/appcache/remove-cache.html [ Crash Failure Timeout ]
-Bug(none) http/tests/appcache/simple.html [ Timeout ]
-Bug(none) http/tests/appcache/top-frame-1.html [ Timeout ]
-Bug(none) http/tests/appcache/top-frame-3.html [ Crash Timeout ]
-Bug(none) http/tests/appcache/top-frame-4.html [ Crash Pass Timeout ]
-Bug(none) http/tests/appcache/update-cache.html [ Timeout ]
-Bug(none) http/tests/appcache/video.html [ Failure Timeout ]
-Bug(none) http/tests/appcache/whitelist-wildcard.html [ Failure ]
-Bug(none) http/tests/appcache/xhr-foreign-resource.html [ Crash Failure Timeout ]
 Bug(none) http/tests/background_fetch/background-fetch-click-event.https.html [ Crash Timeout ]
 Bug(none) http/tests/background_fetch/background-fetch-event.https.html [ Crash Timeout ]
 Bug(none) http/tests/background_fetch/background-fetch-fail-event.https.html [ Crash Timeout ]

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2 b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
index cfdc29d..9be55de 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2

@@ -987,32 +987,22 @@
 # Less invalidations or different invalidations without pixel failures.
 # Some might be good. Some might be under-invalidations for which under-invalidation
 # checking failed.
+Bug(none) paint/invalidation/child-of-sub-pixel-offset-composited-layer.html [ Failure ]
 Bug(none) paint/invalidation/compositing/compositing-reason-removed.html [ Failure ]
 Bug(none) paint/invalidation/compositing/should-invoke-deferred-compositing.html [ Failure ]
 Bug(none) paint/invalidation/css-grid-layout/grid-item-z-index-change-repaint.html [ Failure ]
 Bug(none) paint/invalidation/dont-invalidate-root-layer-when-composited-layer-becomes-visible.html [ Failure ]
 Bug(none) paint/invalidation/flexbox/repaint-opacity-change.html [ Failure ]
+Bug(none) paint/invalidation/invalidate-paint-in-iframe-in-composited-layer.html [ Failure ]
 Bug(none) paint/invalidation/japanese-rl-selection-clear.html [ Failure ]
 Bug(none) paint/invalidation/media-audio-no-spurious-repaints.html [ Failure ]
 Bug(none) paint/invalidation/overflow-changed-on-child-of-composited-layer.html [ Failure ]
-Bug(none) paint/invalidation/overflow-hidden-to-visible.html [ Pass Failure ]
 Bug(none) paint/invalidation/overflow-hidden-yet-scrolled-with-custom-scrollbar.html [ Failure ]
 Bug(none) paint/invalidation/overflow-hidden-yet-scrolled.html [ Failure ]
-Bug(none) paint/invalidation/overflow-scroll-body-appear.html [ Failure ]
 Bug(none) paint/invalidation/paint-invalidation-with-reparent-across-frame-boundaries.html [ Failure ]
-Bug(none) paint/invalidation/svg/clip-path-child-changes.svg [ Failure ]
-Bug(none) paint/invalidation/svg/clip-path-href-changes.svg [ Failure ]
-Bug(none) paint/invalidation/svg/clip-path-id-changes.svg [ Failure ]
-Bug(none) paint/invalidation/svg/clip-path-units-changes.svg [ Failure ]
 Bug(none) paint/invalidation/svg/resize-svg-invalidate-children-2.html [ Failure ]
 Bug(none) paint/invalidation/svg/resize-svg-invalidate-children.html [ Failure ]
 
-# Wrong incremental invalidation for resized images or transformed objects.
-Bug(none) paint/invalidation/image-resize.html [ Failure ]
-Bug(none) paint/invalidation/percent-size-image-resize-container.html [ Failure ]
-Bug(none) paint/invalidation/resize-skewed.html [ Failure ]
-Bug(none) paint/invalidation/resize-with-border-clipped.html [ Pass Failure ]
-
 # The expectation seems incorrect?
 Bug(none) paint/invalidation/paged-with-overflowing-block-rl.html [ Failure ]
 
@@ -1022,6 +1012,10 @@
 Bug(none) paint/invalidation/scroll-fixed-layer-with-reflection.html [ Failure ]
 Bug(none) paint/invalidation/scroll-fixed-reflected-layer.html [ Failure ]
 Bug(none) paint/invalidation/scroll-in-fixed-layer.html [ Failure ]
+Bug(none) paint/invalidation/svg/clip-path-child-changes.svg [ Failure ]
+Bug(none) paint/invalidation/svg/clip-path-href-changes.svg [ Failure ]
+Bug(none) paint/invalidation/svg/clip-path-id-changes.svg [ Failure ]
+Bug(none) paint/invalidation/svg/clip-path-units-changes.svg [ Failure ]
 Bug(none) paint/invalidation/svg/filter-refresh.svg [ Failure ]
 Bug(none) paint/invalidation/svg/image-animation-with-zoom.html [ Pass Failure ]
 Bug(none) paint/invalidation/svg/js-late-clipPath-and-object-creation.svg [ Failure ]
@@ -1032,7 +1026,10 @@
 Bug(none) paint/invalidation/svg/zoom-coords-viewattr-01-b.svg [ Failure ]
 
 # Extra raster invalidations.
+Bug(none) paint/invalidation/clip-path-constant-repaint.html [ Failure ]
+Bug(none) paint/invalidation/compositing/clipping-should-not-repaint-composited-descendants.html [ Failure ]
 Bug(none) paint/invalidation/compositing/fixed-scroll-in-empty-root-layer.html [ Failure ]
+Bug(none) paint/invalidation/compositing/resize-repaint.html [ Failure ]
 Bug(none) paint/invalidation/compositing/scroll-fixed-layer-no-content.html [ Failure ]
 Bug(none) paint/invalidation/compositing/scroll-fixed-layer-out-of-view.html [ Failure ]
 Bug(none) paint/invalidation/compositing/scroll-fixed-squahed-layer.html [ Failure ]
@@ -1060,30 +1057,15 @@
 Bug(none) paint/invalidation/svg/use-detach.svg [ Failure ]
 Bug(none) paint/invalidation/window-resize-percent-html.html [ Failure ]
 
-# Rebaseline
-Bug(none) paint/invalidation/svg/transform-foreign-object.html [ Failure ]
-Bug(none) paint/invalidation/transform-repaint-descendants.html [ Failure ]
-Bug(none) paint/invalidation/window-resize-frameset.html [ Failure ]
-Bug(none) paint/invalidation/filter-repaint-on-accelerated-layer.html [ Failure ]
-Bug(none) paint/invalidation/flexbox/repaint.html [ Failure ]
-Bug(none) paint/invalidation/iframe-display-block-to-display-none.html [ Failure ]
-Bug(none) paint/invalidation/overhanging-float-detach-repaint.html [ Failure ]
-Bug(none) paint/invalidation/positioned-great-grandparent-change-location.html [ Failure ]
-Bug(none) paint/invalidation/selection-after-remove.html [ Failure ]
-Bug(none) paint/invalidation/selection-clear.html [ Failure ]
-Bug(none) paint/invalidation/svg/embedded-svg-size-changes-no-layout-triggers.html [ Failure ]
-# Incorrect expectations (no invalidation)?
-Bug(none) paint/invalidation/video-mute-repaint.html [ Failure ]
-# Incorrect expectations (no invalidation)?
-Bug(none) paint/invalidation/video-unmute-repaint.html [ Failure ]
-
 # Missing painting of scrollbars.
+crbug.com/757938 fast/text/international/vertical-text-glyph-test.html [ Failure ]
 crbug.com/757938 paint/invalidation/background-image-paint-invalidation-large-abspos-div.html [ Failure ]
 crbug.com/757938 paint/invalidation/compositing/newly-composited-on-scroll.html [ Failure ]
 crbug.com/757938 paint/invalidation/compositing/newly-composited-repaint-rect.html [ Pass Failure ]
 crbug.com/757938 paint/invalidation/full-viewport-repaint-for-background-attachment-fixed.html [ Failure ]
 crbug.com/757938 paint/invalidation/inline-style-change-in-scrolled-view.html [ Failure ]
 crbug.com/757938 paint/invalidation/nested-fixed-iframe-scrolled.html [ Failure ]
+crbug.com/757938 paint/invalidation/overflow-scroll-body-appear.html [ Failure ]
 crbug.com/757938 paint/invalidation/repaint-during-scroll.html [ Failure ]
 crbug.com/757938 paint/invalidation/svg/repaint-in-scrolled-view.html [ Failure ]
 crbug.com/757938 paint/invalidation/svg/text-xy-updates-SVGList.xhtml [ Failure ]
@@ -1141,48 +1123,27 @@
 Bug(none) paint/invalidation/backgroundSizeRepaint.html [ Failure ]
 Bug(none) paint/invalidation/clipped-overflow-visible-subtree.html [ Failure ]
 Bug(none) paint/invalidation/compositing/fixed-pos-with-abs-pos-child-scroll.html [ Failure ]
+Bug(none) paint/invalidation/compositing/should-not-repaint-scrolling-contents-outline-change.html [ Failure ]
 Bug(none) paint/invalidation/create-layer-repaint.html [ Failure ]
 Bug(none) paint/invalidation/filter-on-html-element-with-fixed-position-child.html [ Failure ]
+Bug(none) paint/invalidation/invalidate-caret-in-composited-scrolling-container.html [ Failure ]
+Bug(none) paint/invalidation/invalidate-caret-in-non-composited-scrolling-container.html [ Failure ]
 Bug(none) paint/invalidation/mix-blend-mode-separate-stacking-context.html [ Failure ]
 Bug(none) paint/invalidation/paint-invalidation-with-opacity.html [ Failure ]
 Bug(none) paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-1.html [ Failure ]
 Bug(none) paint/invalidation/svg/deep-nested-embedded-svg-size-changes-no-layout-triggers-2.html [ Failure ]
 
-# Layer tree differences about layer properties ("contentsOpaque", "backfaceVisibility",
-# "transform", "drawsContents", etc.)
-Bug(none) paint/invalidation/animated-gif-transformed-offscreen.html [ Failure ]
-Bug(none) paint/invalidation/child-of-sub-pixel-offset-composited-layer.html [ Failure ]
-Bug(none) paint/invalidation/clip-path-constant-repaint.html [ Failure ]
-Bug(none) paint/invalidation/composited-table-row.html [ Failure ]
-Bug(none) paint/invalidation/composited-vertical-rl-overflow.html [ Failure ]
-Bug(none) paint/invalidation/compositing/clipping-should-not-repaint-composited-descendants.html [ Failure ]
+# contentsOpaque
 Bug(none) paint/invalidation/compositing/containing-block-added.html [ Failure ]
 Bug(none) paint/invalidation/compositing/containing-block-added-individual.html [ Failure ]
 Bug(none) paint/invalidation/compositing/containing-block-removed.html [ Failure ]
 Bug(none) paint/invalidation/compositing/containing-block-removed-individual.html [ Failure ]
-Bug(none) paint/invalidation/compositing/should-not-repaint-composited-transform.html [ Failure ]
 Bug(none) paint/invalidation/compositing/should-not-repaint-composited-z-index.html [ Failure ]
-Bug(none) paint/invalidation/compositing/should-not-repaint-scrolling-contents-outline-change.html [ Failure ]
-Bug(none) paint/invalidation/compositing/resize-repaint.html [ Failure ]
 Bug(none) paint/invalidation/destroy-composited-scrollbar.html [ Failure ]
-Bug(none) paint/invalidation/invalidate-caret-in-composited-scrolling-container.html [ Failure ]
-Bug(none) paint/invalidation/invalidate-caret-in-non-composited-scrolling-container.html [ Failure ]
-Bug(none) paint/invalidation/invalidate-cell-in-row-with-offset.html [ Failure ]
-Bug(none) paint/invalidation/invalidate-paint-in-iframe-in-composited-layer.html [ Failure ]
-Bug(none) paint/invalidation/multiple-backgrounds-style-change.html [ Failure ]
-Bug(none) paint/invalidation/relative-inline-positioned-movement-repaint.html [ Failure ]
-Bug(none) paint/invalidation/svg/animated-svg-as-image-transformed-offscreen.html [ Failure ]
-Bug(none) paint/invalidation/svg/transform-focus-ring-repaint.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background-composited-row-initial-empty.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background-composited-row.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background-initial-empty.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background-section-composited-row.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background-section-initial-empty.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background-section.html [ Failure ]
-Bug(none) paint/invalidation/table/composited-table-background.html [ Failure ]
-Bug(none) paint/invalidation/window-resize-background-image-fixed-centered-composited.html [ Failure ]
+Bug(none) paint/invalidation/filter-repaint-on-accelerated-layer.html [ Failure ]
 
-# Wrong invalidation for multicol. Different layer tree.
+# Wrong invalidation/painting/rasterization for multicol. Different layer tree.
+crbug.com/648274 fast/text/letter-spacing-leading-and-trailing.html [ Failure ]
 crbug.com/648274 paint/invalidation/column-rules-fixed-height.html [ Failure ]
 crbug.com/648274 paint/invalidation/multicol-as-paint-container.html [ Failure ]
 crbug.com/648274 paint/invalidation/multicol-nested.html [ Failure ]

diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process b/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process
index d7b6fb3..a55ff87 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process

@@ -66,8 +66,10 @@
 # https://crbug.com/585188 - testRunner.addOriginAccessWhitelistEntry is not replicated to OOPIFs.
 crbug.com/585188 http/tests/xmlhttprequest/origin-whitelisting-all.html [ Failure ]
 crbug.com/585188 virtual/mojo-loading/http/tests/xmlhttprequest/origin-whitelisting-all.html [ Failure ]
+crbug.com/585188 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-all.html [ Failure ]
 crbug.com/585188 http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html [ Failure ]
 crbug.com/585188 virtual/mojo-loading/http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html [ Failure ]
+crbug.com/585188 virtual/outofblink-cors/http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html [ Failure ]
 
 # https://crbug.com/601584 - No OOPIF support for UserGestureIndicator triggers
 #                            cross-origin-iframe.html layout test failure

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index cebbade4..5556eb5e 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -3615,7 +3615,7 @@
 crbug.com/667560 [ Win7 Debug ] virtual/mojo-loading/http/tests/devtools/tracing/frame-model-instrumentation.html [ Pass Timeout ]
 crbug.com/757955 [ Win7 Debug ] storage/indexeddb/mozilla/cursors.html [ Pass Timeout ]
 crbug.com/757955 [ Win7 Debug ] storage/indexeddb/objectstore-cursor.html [ Pass Timeout ]
-crbug.com/757955 [ Win7 Debug ] http/tests/devtools/tracing/timeline-paint/layer-tree.html [ Pass Timeout ]
+crbug.com/757955 [ Win7 Debug ] http/tests/devtools/tracing/timeline-paint/layer-tree.html [ Pass Failure Timeout ]
 crbug.com/757955 [ Win7 Debug ] virtual/threaded/transitions/transition-end-event-transform.html [ Pass Failure ]
 
 # Tests failing on WebKit Win7 (dbg), disable for now
@@ -3642,6 +3642,8 @@
 crbug.com/760543 [ Linux Release ] virtual/mojo-loading/http/tests/devtools/tracing/timeline-style/timeline-style-recalc-with-invalidator-invalidations.html [ Pass Timeout ]
 crbug.com/760543 [ Linux Release ] virtual/mojo-loading/http/tests/devtools/tracing/timeline-misc/timeline-event-causes.html [ Pass Timeout ]
 crbug.com/760543 [ Linux Release ] virtual/mojo-loading/http/tests/devtools/tracing/timeline-paint/timeline-paint-with-layout-invalidations-on-deleted-node.html [ Pass Timeout ]
+crbug.com/760543 [ Linux Release ] virtual/mojo-loading/http/tests/devtools/tracing/timeline-time/timeline-usertiming.html [ Pass Timeout ]
+crbug.com/760543 [ Linux Release ] virtual/mojo-loading/http/tests/devtools/tracing/timeline-paint/timeline-paint.html [ Pass Timeout ]
 
 # Tests crashing or timing out on WebKit Linux Trusty ASAN
 crbug.com/760904 [ Linux Release ] svg/as-image/svg-nested.html [ Pass Crash Timeout ]

diff --git a/third_party/WebKit/LayoutTests/accessibility/aom-actions.html b/third_party/WebKit/LayoutTests/accessibility/aom-actions.html
index 23ed494..743465c 100644
--- a/third_party/WebKit/LayoutTests/accessibility/aom-actions.html
+++ b/third_party/WebKit/LayoutTests/accessibility/aom-actions.html

@@ -240,115 +240,3 @@
   });
 }, "AOM event bubbling respects aria-owns over DOM parent chain");
 </script>
-
-<button id="context_menu_target">Context Menu Target</button>
-
-<script>
-async_test(function(t) {
-  enableAccessibilityEventsPermission().then(function() {
-    var target = document.getElementById("context_menu_target");
-    var axTarget = accessibilityController.accessibleElementById("context_menu_target");
-
-    var gotDOMEvent = false;
-    target.addEventListener("contextmenu", function(event) {
-      event.preventDefault();
-      gotDOMEvent = true;
-    });
-    var gotAccessibleEvent = false;
-    target.accessibleNode.onaccessiblecontextmenu = function() {
-      gotAccessibleEvent = true;
-    };
-    axTarget.showMenu();
-
-    assert_true(gotAccessibleEvent);
-    assert_true(gotDOMEvent);
-    t.done();
-  });
-}, "AccessibleNode.onaccessiblecontextmenu");
-</script>
-
-<input type=range min=1 max=5 value=3 id="decrement_target">
-
-<script>
-async_test(function(t) {
-  enableAccessibilityEventsPermission().then(function() {
-    var target = document.getElementById("decrement_target");
-    var axTarget = accessibilityController.accessibleElementById("decrement_target");
-
-    var gotAccessibleEvent = false;
-    target.accessibleNode.onaccessibledecrement = function() {
-      gotAccessibleEvent = true;
-    };
-    axTarget.decrement();
-
-    assert_true(gotAccessibleEvent);
-    assert_equals(target.value, "2");
-    t.done();
-  });
-}, "AccessibleNode.onaccessibledecrement");
-</script>
-
-<input type=range min=1 max=5 value=3 id="increment_target">
-
-<script>
-async_test(function(t) {
-  enableAccessibilityEventsPermission().then(function() {
-    var target = document.getElementById("increment_target");
-    var axTarget = accessibilityController.accessibleElementById("increment_target");
-
-    var gotAccessibleEvent = false;
-    target.accessibleNode.onaccessibleincrement = function() {
-      gotAccessibleEvent = true;
-    };
-    axTarget.increment();
-
-    assert_true(gotAccessibleEvent);
-    assert_equals(target.value, "4");
-    t.done();
-  });
-}, "AccessibleNode.onaccessibleincrement");
-</script>
-
-<input id="focus_target">
-
-<script>
-async_test(function(t) {
-  enableAccessibilityEventsPermission().then(function() {
-    var target = document.getElementById("focus_target");
-    var axTarget = accessibilityController.accessibleElementById("focus_target");
-
-    var gotAccessibleEvent = false;
-    target.accessibleNode.onaccessiblefocus = function() {
-      gotAccessibleEvent = true;
-    };
-    axTarget.takeFocus();
-
-    assert_true(gotAccessibleEvent);
-    assert_equals(document.activeElement, target);
-    t.done();
-  });
-}, "AccessibleNode.onaccessiblefocus");
-</script>
-
-<input id="scroll_target" style="margin-top: 1000px;">
-
-<script>
-async_test(function(t) {
-  enableAccessibilityEventsPermission().then(function() {
-    var target = document.getElementById("scroll_target");
-    var axTarget = accessibilityController.accessibleElementById("scroll_target");
-
-    var oldY = window.pageYOffset;
-
-    var gotAccessibleEvent = false;
-    target.accessibleNode.onaccessiblescrollintoview = function() {
-      gotAccessibleEvent = true;
-    };
-    axTarget.scrollToMakeVisible();
-
-    assert_true(gotAccessibleEvent);
-    assert_true(window.pageYOffset > oldY);
-    t.done();
-  });
-}, "AccessibleNode.onaccessiblescroll");
-</script>

diff --git a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
index 7c7dac6..56858f4 100644
--- a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json

@@ -68377,11 +68377,6 @@
      {}
     ]
    ],
-   "FileAPI/historical.https-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "FileAPI/idlharness.idl": [
     [
      {}
@@ -86482,6 +86477,11 @@
      {}
     ]
    ],
+   "css/css-tables-3/fixed-layout-excess-width-distribution-001-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "css/css-tables-3/floats/floats-wrap-bfc-006b-ref.xht": [
     [
      {}
@@ -86497,6 +86497,11 @@
      {}
     ]
    ],
+   "css/css-tables-3/support/check-layout-th.js": [
+    [
+     {}
+    ]
+   ],
    "css/css-tables-3/visibility-collapse-colspan-003-ref.html": [
     [
      {}
@@ -95157,6 +95162,16 @@
      {}
     ]
    ],
+   "cssom-view/elementFromPoint-002-expected.txt": [
+    [
+     {}
+    ]
+   ],
+   "cssom-view/elementFromPoint-003-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "cssom-view/elementFromPosition-expected.txt": [
     [
      {}
@@ -98127,6 +98142,11 @@
      {}
     ]
    ],
+   "fetch/api/headers/headers-record-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "fetch/api/policies/csp-blocked-worker-expected.txt": [
     [
      {}
@@ -98492,11 +98512,6 @@
      {}
     ]
    ],
-   "fetch/api/response/response-consume-stream-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "fetch/api/response/response-idl-expected.txt": [
     [
      {}
@@ -110677,6 +110692,11 @@
      {}
     ]
    ],
+   "images/smiley.png.headers": [
+    [
+     {}
+    ]
+   ],
    "images/threecolors.png": [
     [
      {}
@@ -112032,11 +112052,6 @@
      {}
     ]
    ],
-   "mixed-content/imageset.https.sub-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "mixed-content/optionally-blockable/http-csp/cross-origin-http/audio-tag/top-level/keep-scheme-redirect/opt-in-blocks.https.html.headers": [
     [
      {}
@@ -115862,11 +115877,6 @@
      {}
     ]
    ],
-   "resource-timing/test_resource_timing-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "resource-timing/test_resource_timing.js": [
     [
      {}
@@ -120052,6 +120062,11 @@
      {}
     ]
    ],
+   "webstorage/resources/storage_session_window_noopener_second.html": [
+    [
+     {}
+    ]
+   ],
    "webstorage/resources/storage_session_window_open_second.html": [
     [
      {}
@@ -120062,6 +120077,11 @@
      {}
     ]
    ],
+   "webstorage/storage_session_window_noopener-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "webstorage/storage_string_conversion-expected.txt": [
     [
      {}
@@ -125362,6 +125382,12 @@
      {}
     ]
    ],
+   "2dcontext/imagebitmap/createImageBitmap-invalid-args.html": [
+    [
+     "/2dcontext/imagebitmap/createImageBitmap-invalid-args.html",
+     {}
+    ]
+   ],
    "2dcontext/imagebitmap/createImageBitmap-sizeOverflow.html": [
     [
      "/2dcontext/imagebitmap/createImageBitmap-sizeOverflow.html",
@@ -135136,6 +135162,12 @@
      {}
     ]
    ],
+   "css/css-fonts-3/test_datafont_same_origin.html": [
+    [
+     "/css/css-fonts-3/test_datafont_same_origin.html",
+     {}
+    ]
+   ],
    "css/css-fonts-3/test_font_family_parsing.html": [
     [
      "/css/css-fonts-3/test_font_family_parsing.html",
@@ -136114,6 +136146,12 @@
      {}
     ]
    ],
+   "css/css-tables-3/fixed-layout-excess-width-distribution-001.html": [
+    [
+     "/css/css-tables-3/fixed-layout-excess-width-distribution-001.html",
+     {}
+    ]
+   ],
    "css/css-tables-3/visibility-collapse-col-001.html": [
     [
      "/css/css-tables-3/visibility-collapse-col-001.html",
@@ -137776,6 +137814,18 @@
      {}
     ]
    ],
+   "cssom-view/elementFromPoint-002.html": [
+    [
+     "/cssom-view/elementFromPoint-002.html",
+     {}
+    ]
+   ],
+   "cssom-view/elementFromPoint-003.html": [
+    [
+     "/cssom-view/elementFromPoint-003.html",
+     {}
+    ]
+   ],
    "cssom-view/elementFromPoint.html": [
     [
      "/cssom-view/elementFromPoint.html",
@@ -147314,6 +147364,12 @@
      {}
     ]
    ],
+   "html/semantics/document-metadata/the-style-element/style_type_change.html": [
+    [
+     "/html/semantics/document-metadata/the-style-element/style_type_change.html",
+     {}
+    ]
+   ],
    "html/semantics/document-metadata/the-title-element/title.text-01.html": [
     [
      "/html/semantics/document-metadata/the-title-element/title.text-01.html",
@@ -149892,6 +149948,12 @@
      {}
     ]
    ],
+   "html/semantics/selectors/pseudo-classes/checked-type-change.html": [
+    [
+     "/html/semantics/selectors/pseudo-classes/checked-type-change.html",
+     {}
+    ]
+   ],
    "html/semantics/selectors/pseudo-classes/checked.html": [
     [
      "/html/semantics/selectors/pseudo-classes/checked.html",
@@ -149946,12 +150008,24 @@
      {}
     ]
    ],
+   "html/semantics/selectors/pseudo-classes/indeterminate-type-change.html": [
+    [
+     "/html/semantics/selectors/pseudo-classes/indeterminate-type-change.html",
+     {}
+    ]
+   ],
    "html/semantics/selectors/pseudo-classes/indeterminate.html": [
     [
      "/html/semantics/selectors/pseudo-classes/indeterminate.html",
      {}
     ]
    ],
+   "html/semantics/selectors/pseudo-classes/inrange-outofrange-type-change.html": [
+    [
+     "/html/semantics/selectors/pseudo-classes/inrange-outofrange-type-change.html",
+     {}
+    ]
+   ],
    "html/semantics/selectors/pseudo-classes/inrange-outofrange.html": [
     [
      "/html/semantics/selectors/pseudo-classes/inrange-outofrange.html",
@@ -152420,12 +152494,6 @@
      {}
     ]
    ],
-   "imagebitmap/createImageBitmap-invalid-args.html": [
-    [
-     "/imagebitmap/createImageBitmap-invalid-args.html",
-     {}
-    ]
-   ],
    "infrastructure/failing-test.html": [
     [
      "/infrastructure/failing-test.html",
@@ -180256,6 +180324,12 @@
      }
     ]
    ],
+   "webstorage/storage_session_window_noopener.html": [
+    [
+     "/webstorage/storage_session_window_noopener.html",
+     {}
+    ]
+   ],
    "webstorage/storage_session_window_open.html": [
     [
      "/webstorage/storage_session_window_open.html",
@@ -188887,6 +188961,10 @@
    "56ebe218b07fe534ded2c5734c0ecbd1b4c30d49",
    "testharness"
   ],
+  "2dcontext/imagebitmap/createImageBitmap-invalid-args.html": [
+   "e839d537057d03f55108b871d2d32272cac7bc7f",
+   "testharness"
+  ],
   "2dcontext/imagebitmap/createImageBitmap-sizeOverflow.html": [
    "977be16edd03dcfa70f3c6f987bad1455e44b93f",
    "testharness"
@@ -190651,10 +190729,6 @@
    "fa1e9bd48a2e1f5fe91e6f9b3aa401b4ccf15dfa",
    "support"
   ],
-  "FileAPI/historical.https-expected.txt": [
-   "e20c78ae7cd2f1c5e5730da420c390b9239c3d8b",
-   "support"
-  ],
   "FileAPI/historical.https.html": [
    "93903b4f58bc215ea2a67fc6d281593ec5ce79e9",
    "testharness"
@@ -192880,11 +192954,11 @@
    "testharness"
   ],
   "XMLHttpRequest/abort-after-send-expected.txt": [
-   "558ee8511dccc712821d5e4b794a791c10207e87",
+   "e5b47c4b2e4db1ba9bd647414dbec1fa2dd952e0",
    "support"
   ],
   "XMLHttpRequest/abort-after-send.htm": [
-   "0491be6129a5d78a55d043f3dc0b5322611b9485",
+   "1ec12c1906dd99e9c048925c560ce1b9ac1a4410",
    "testharness"
   ],
   "XMLHttpRequest/abort-after-stop.htm": [
@@ -221667,6 +221741,10 @@
    "2a8f7afbb6ccfc4084534c36bd4cfeebcbae4194",
    "manual"
   ],
+  "css/css-fonts-3/test_datafont_same_origin.html": [
+   "a793f06cceb92b34dc27728307995774a5d95b63",
+   "testharness"
+  ],
   "css/css-fonts-3/test_font_family_parsing-expected.txt": [
    "c1dbd5633e13d63510d184c1b2c7260d060d36e9",
    "support"
@@ -221932,71 +222010,71 @@
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-001.html": [
-   "71d678f48849879663d199ec57a5f19fb5e026b3",
+   "5622a264eb2dbd6cf621ac97aa4a8ae5db82c6b3",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-002.html": [
-   "a20d044edc50199306349700b03522225841fc72",
+   "2c62d06a72062571ede87351e2538e386807e0b9",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-003.html": [
-   "4ef0c09a8c51e4fd2979887fe7420a62eb783027",
+   "c07303851028f6421158fe307889a7a53d7f31e0",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-004.html": [
-   "f1f2f65fad70478230f2456cbdf68ead9c6de7f6",
+   "f8692678b09611f1bcb5f1a1446f4eaeeadb64ac",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-005.html": [
-   "cf1c4546b569bea0bea062736ccea0e9e4f934ac",
+   "7d0900472ae1237a92d1070ac434e7f56f537a52",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-006.html": [
-   "f0f17f458563b57a39ff7b684996edfede82e510",
+   "ca8fea1a3e366d3dda1f939d6e119949a3774c48",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-007.html": [
-   "08db6086c6a30888fee6881d6646d42c509d218b",
+   "01482b8fae411849e91dae8390d9bfe6e6ab9844",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-008.html": [
-   "66d112eae6876a44c2246312719c2e6a3b93a5eb",
+   "77bb5394d7628566d07047220a08aba58970cf6b",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-009.html": [
-   "a27003f50acf7ff550d99b14a4a4435f80e791c0",
+   "b5ded29b361ee406736a514d00743915ee7588c5",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-010.html": [
-   "1f59c3d1af79df13007d0ba29132917a6e075e54",
+   "c0a3834676fa8bb146441bb7bc969560c667d1e0",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-011.html": [
-   "edaf37eff5ed1db1709729e669aee460457de3ec",
+   "f9be3a544d65dd63f8a718b0884fd87bcebc34a0",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-012.html": [
-   "6ba269671145f1f8d5a32f6a1efe5927a695f693",
+   "ee86f5d97a3db4b22f3ea5e9cec5d1f603401d36",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-013.html": [
-   "a2036358ed56a79580d675cccd820e40b82bb3d0",
+   "ef01ff8ea9d9357382c59fca4832901e091b58b6",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-014.html": [
-   "9e20812f1655d4bbbde261694deee0c1d09ff214",
+   "db95b9693a1e8986d81fb0fb42b045226ae87de2",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-015.html": [
-   "d49d3b8b7a92a7cae108d7baa9d40b95699149aa",
+   "818bb47cab93792162cd3effbb1ab4bbf4cafeb4",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-016.html": [
-   "9ac8ed870190e63aa9e248cf41c81c41b4816442",
+   "c5a38881fd5302f7f87fc0a08048455c2f9c6d93",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-017.html": [
-   "7295162365f4929cf68ebad634be1d3bd6f7227a",
+   "4ad7a14d8e640963a7b19401e5805d20379da1ad",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-018.html": [
@@ -222004,367 +222082,367 @@
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-019.html": [
-   "5e97218c93c95bd57edd96219a520a894184b2b6",
+   "4a72208bc09151b5b6b471582c7211d1c6e1abf9",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-020.html": [
-   "228cd6b2312f64f7ae7bb1421fb6b8c5e6bb4c22",
+   "cb61983358d8df21f445c52e2b4672f036b92930",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-021.html": [
-   "a626f563a51ef70a0a6221dd397c4ea9dce74f2c",
+   "9be4696e87426cb7d7bbfbd623012427e1211e15",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-022.html": [
-   "0699d18ff695b8920588304e9685f843fa006b4f",
+   "bc821e4fdc223b8f73c640f7dedc74c459cc6124",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-023.html": [
-   "788e76b9f562e1a2af800b8939d8cd6dccdaf991",
+   "1cf05242c1918dfd94c8e3f429296696f1fbf2a5",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-024.html": [
-   "d0f957e475c3c0934a3d84e64ea6552e47cfac7a",
+   "ed4439dcc8fca88286db1b6fbbfb9130f37bf17d",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-025.html": [
-   "136e1a1999f3696a5742cb53a0d30e6411cfa6f4",
+   "ada440cf035137bd6c5377d543de603802a10680",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-001.html": [
-   "0681924a44ddc7c141a8c20203289c0862e7ec7c",
+   "a4fb6eded9c20195017f73aacf53d08fff0fe990",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-002.html": [
-   "e7771a519139a375f641125ea2a0a90102d228c7",
+   "a87a2c260aaa872ec9ea5699a0dcfa106e45bb2b",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-003.html": [
-   "7ff3085ec34b3fe9664ef0a9e02ebe862c42c22f",
+   "1ae67e7963212bf6afa678b929873d86cec025e1",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-004.html": [
-   "c474e6c83ca32385734a035fd36ef41e2e666f24",
+   "bc0978ff89ec6af691f88aa88e2b805f17012368",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-005.html": [
-   "c5a5d80b273add95223306d99471d3a030fb8be6",
+   "2b5a655c5a934b98c0d7fcb8553eb8efa35cb5af",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-006.html": [
-   "55d9f476640c87eb1663114599ddb6eafd91b7f0",
+   "712436aec944f0e7163da66a62d8a629a1c7ce80",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-007.html": [
-   "d81f70fda4665e94cd32483127e069dec9b760cc",
+   "fa284f5404d3e24cc395a37380291cf58440e447",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-008.html": [
-   "d4f0fde36ff5b437ebda34698d199cce359f00fa",
+   "24253384b12c5c20ef44dd14d882ab35a7a411f2",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-009.html": [
-   "5a50c58f6b9ba8b4b51b020b93ee61d23bfb500f",
+   "a89a85650c01a24a088b5b704805389ac487afc7",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-010.html": [
-   "fa5cc94c766ac0d455326bb117ae530df0ce6d4d",
+   "a676ad7b1ad0dc6ad205d767a4e366d43b2d1600",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-011.html": [
-   "3f02b75738ac80f1875a3adc0ce07052841c6be4",
+   "c53c339b5ac8ea5f9b021cca8eca56bbffa25ead",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-012.html": [
-   "97dac1879d441e29c97743e9e63bb44f6a413f67",
+   "d8746b969ea563cc8e683d00824a239cb9f45953",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-013.html": [
-   "99832804da447b3cc35db8bb60492781a03ffb62",
+   "94aef014e0d0bb420a8d7421ebabb2a9699a14b4",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-014.html": [
-   "2cc1f4a715b939a882d7394cb0d49d5ba4b127c7",
+   "1eec29a79380f6fb9e55f5e65f61f9fb906da192",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-015.html": [
-   "8b1947a434ec968a5bd0170334e7e2c907e69f28",
+   "c792926de9e4a1923b5f67c44095fc5609f03f79",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-016.html": [
-   "998612427cda18f277c5edf484892fd3b313bffc",
+   "3cda565159049d2b6d715166d9835041cb4918df",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-017.html": [
-   "080c87419291575847c9e94eadf5096f4a438bb3",
+   "1d387c5780df35128eabaec4d431cb92c7f96d0f",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-018.html": [
-   "aec32266b3e66fb38f45888140bf773d537728c9",
+   "dc470e6ad001ba3c32a264941a5a245a8241a91f",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-019.html": [
-   "6891c290c82adce07bb2409732789b627f07ded0",
+   "425356e77beca062326b6902b0dc0322bf081e72",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-020.html": [
-   "0ea2837b789ce2289aa2ec1c514006899d13def7",
+   "8bd9b585fe347a4be4ef2df571164ccd5a2163b5",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-021.html": [
-   "0e2a972619d21b4de097ddca6f39f2cae486cc5c",
+   "f8127fd46686ae877b0ca01b26d0278a49fa898e",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-022.html": [
-   "fb73bdbdff8fda79519e4fe387127ca539506357",
+   "e8094181ef73d466757fef11a439efa1af839a06",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-023.html": [
-   "c8b2681075b476b15221bcb1fe1ea6a4e0c40409",
+   "c62f2d4b7bc3e85cc51b46b97e7281a7030e39a6",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-024.html": [
-   "6446e5dede7383a43ac46b8083b6012b312a8124",
+   "046b9b3ebcc52c5ef1a5448ebef9ede1f0ed39f7",
    "reftest"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-001.html": [
-   "4ebbf6afe7452b5a61c9a475b7beb3958dd39ee5",
+   "faa0a4a8e6660d8bb12cec2ccbe86e8e23bcc936",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-002.html": [
-   "a1b58d6358acae0e0a4d48ec2e896b5a86b296bf",
+   "735b425c34d147a32b97e60606a5d088389fecfc",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-003.html": [
-   "3d0b16a4ad5d537fa2728e630bf81d8a55303cd4",
+   "7f5a41bc81b97bb4b62e55b69fa1ecfe241edaed",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-004.html": [
-   "71f1966a0c3f899dd3b2601d225ec5683514e296",
+   "0e12bf8b99c417c9176100f7b945b9a83d53f69c",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-005.html": [
-   "c95fbde16d02ff01eab5e39a1f9b66ab5d0ca88c",
+   "d28606de466e787ac8e4c1f742806c2bbf570a88",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-006.html": [
-   "3bf926a4638e8a7a36d255e3a54c2b33e978c850",
+   "2ea3e018bf73940231af89dc72c2352fe2985732",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-007.html": [
-   "00a3a65a3028898decd5b33dc749d1d4b61c05f5",
+   "d2ff7e0efbb1240bfa4b21b0d2e7eb0891950348",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-008.html": [
-   "f7058e3180965b0b85b83d66cc3623e4d6ed081c",
+   "0ee2f7d1f4bed6383a762f86efa6dc2a8a27bf4b",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-009.html": [
-   "c56e42e2c7726204f112bc124adf6bf4e75e1c83",
+   "d64052253097bade696ff9c8bee42bfa8cca9604",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-010.html": [
-   "cbec5d103a8c29e5af97a54fe856c250ced3ee69",
+   "9523288742cb15e2451b41b85596ff868b6b4648",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-011.html": [
-   "b2556efc42d96830190ef6bbe0fdeef7c939cd76",
+   "9929a38f502a2e82ae93b6a39910eacb04ee6e58",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-012.html": [
-   "7700cff07f4930e4453c7dabef98ff41dd85f04b",
+   "9a19df31cfded6c4270da40070c3e8390c8366b2",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-013.html": [
-   "64c4f341755b5bef5772cc164427033fbf3d44f3",
+   "a8cb352297f011b42b3740fd73f2f78f0bdca29d",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-014.html": [
-   "e7f19c6990b60e8d527089d600d0b5d585f37d42",
+   "11e3cb854d0c9fb7535a7408a56e9f372acf7b74",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-015.html": [
-   "516f95b9ab855414499423cc0b6354b37735c428",
+   "7b145fe80d78b51f42f1a257e64b77f256324029",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-016.html": [
-   "4e6a1caea23ac6a54e2e6f5fd9585d574dd615aa",
+   "3d7b17fa76b3f21ccd882072158f25c723698b24",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-001.html": [
-   "ba37dd2cb887de2c6a577e7ad538f588f6c2a6b5",
+   "613da8787ea601c01cd79348e68d94cbdf4f6c12",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-002.html": [
-   "2a88930bce761a86b84bc39cbbb9c6c4fb1ade6f",
+   "bfbfeef9485cd0a842729d72ae6a7d2978fed0ee",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-003.html": [
-   "1a598d7e5c0a63aedb6fa83a81084707a97082bd",
+   "47f8fa7e366a0928a1ef6ee30d3e97898d10b882",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-004.html": [
-   "aba771e25d3801ea42786fd006e5e444605fed9e",
+   "0277d86138e1e5aecea0fcde768a48a8b841046c",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-005.html": [
-   "45aee24069e89a238c99b61ee905ab516fc1fe4e",
+   "b82ead09258f8746f6c7d4d9fd363b2bdfe2fe42",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-006.html": [
-   "481ed2e3a960f5e3da1dde22245d1da6f33cd344",
+   "290d852faea189b602457356f6abf8df51f4e306",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-007.html": [
-   "62b193d96908b1950ad8d7ff994e7f0718b3a9f1",
+   "f8418fe79ca641e453791ca1c202cdad50220b2e",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-008.html": [
-   "55f131bf1a0566068b0882ec90cd37e257b9b28a",
+   "10e77671b9a37de05f4898e035aa29fde999f64c",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-009.html": [
-   "d2ae2b5839c06f483740ee96fbd718110515d095",
+   "9f7f821d8fd60bf5ab47f5341a3a103afe94d3a8",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-010.html": [
-   "90cbedb0e00ad7da4b3d9627804d668e160935eb",
+   "f5327de3394428415fed804e4e79efc0fe963817",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-011.html": [
-   "53f3a18185535c7310df5ba9132e63cad8daa651",
+   "a7aac5da4c4e085b14c77a0088a4d608c637f9bc",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-012.html": [
-   "170a800b282312f4f4e35845b4d6009b3e491ca4",
+   "b35ad113f09d62cb40cf4a16ff6faca82d73de35",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-013.html": [
-   "ec7e80425ea1e5df487f43d62d1bbf8e5774d294",
+   "5e97e65254d39476e883cb847d421a54496c71a8",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-014.html": [
-   "66d1929467cee9b75c05c30f1be0b29969646b1d",
+   "cf7374a5f900e4d6a675dc32a9181cfd1653075d",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-015.html": [
-   "d22228744c0dfab1d541361812317680c8e6db34",
+   "1ebbfc6564b9c8350fa618bea97ecab3fb44eade",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-016.html": [
-   "6a5b4f1e3f8713ec386971b90c152844a1963153",
+   "74711c54c4c2148895e75132d9cebc225a9128a2",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-001.html": [
-   "f3839a8b379099186f499886a2687d879941e553",
+   "a4d4dec0f3fb7f490c2e046d535d8f86a89ec519",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-002.html": [
-   "f2e48ba123603f1617302a842d13b41f8a134791",
+   "2ab21074fa42c487f294866c39859e06364715de",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-003.html": [
-   "9cf06a6284b8ea46a451b750b634800edf0a263e",
+   "695ee5fa198c111a3f8dcee1520938878b003410",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-004.html": [
-   "ee801dc782b31539787b108e2249163648fb9476",
+   "6625c4aa82c02c86075a49d0485160b24f5ed5b6",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-005.html": [
-   "595f81d3ca4465d53968b1a5e7d2c5ef9364e1d7",
+   "5c400ff43392287f0203102c100ae1d286286e94",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-006.html": [
-   "d824792aa48927230d5d79413d6b31ff9e6a9044",
+   "5c4f715f864ee0718a28cd56aef5bb63549042da",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-007.html": [
-   "7875a1c3f5bd7ed5f9bc6d57ee55a74eae70d08c",
+   "82b67b0f255a36275c9e2179f7c0a6c194b80881",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-008.html": [
-   "a91f9d4cd8375f9a3843df68c1699be43464a519",
+   "df9a693d3d6a7ecfb8767b1e53af0f71b54e4cac",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-009.html": [
-   "b34bf92f1eb907ed1cae789ca5d0526180746a8d",
+   "9223ee50b9c22c737e42f113e67418c3b9f42312",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-010.html": [
-   "923c6fbd83ef1df81c92f3b818d5ed6bc8545eb8",
+   "065d965da5145e629517941de214c53a990e7d04",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-011.html": [
-   "30701ba96fd590d43fa4d69e2393493812950a9e",
+   "819fb3899679610911df95110f051973ef4fcbb6",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-012.html": [
-   "eb4d83cc9c0053fd305994ce7eeb7015a75a85d3",
+   "52459738d7455d7ed97045aea124b2160d37643a",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-013.html": [
-   "3d1e1bd37812a4707305255afa4ff94433995771",
+   "09be06f107f5ea97fc6db45b8bca150e10dc7296",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-014.html": [
-   "746b1f48171561ad5aacc7ce282592fefbb2ab3e",
+   "0270a89bde2e54d3108d8ab8b8dbb3f64ae855af",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-015.html": [
-   "a913de9564b2e44fec43b66177cc6b94cb174a08",
+   "f49ae99abd185af7bc9937c16bb7f4bb2044bdc6",
    "testharness"
   ],
   "css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-016.html": [
-   "749d78928a228bb67878b3c088d36bcfd010aa08",
+   "86d478dee444129ccd10f76aed6d80c75251ff13",
    "testharness"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-001.html": [
-   "afb6c282b7e952878c52c198579541ddca6afdb6",
+   "e7250b61f6dc882945f73412ec73c0de7f139aad",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-002.html": [
-   "67a739c055f22f9de478d7d62a56bb9e65415cfb",
+   "083e1bed1a996e0a333456163df2610d94acd682",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-003.html": [
-   "3ccf5136030949e11a305349d317af193fe4f0ff",
+   "4ce945c003fe0ea32b6d92ace158f3975ec557bd",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-004.html": [
-   "30a0be3371587b0871bbc480aa7e7098c4bc51e6",
+   "5d67cb17c0af2c67282c454b5dcc4b0eaf346220",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-005.html": [
-   "b4782cea1a8ec242087271555d55bae0f574fa91",
+   "d12ea65c89b6df11bdc0e9cbfd92b72084fe9709",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-006.html": [
-   "c6a597f7e720491cd09ba3007cc50234639cdc33",
+   "04c3d0b31ecdac7281680f551c3d2368985f7acd",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-007.html": [
-   "2593b5f169c3fd0778cda370821572057ae25f0d",
+   "4163237401ba3f1e8e7bb8f4cd85c130aad85079",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-008.html": [
-   "0eb8c0b70ff376de7608cb843838ea35556bef08",
+   "9322237dea7e159bdab91cf9e7964e81a19a6240",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-009.html": [
-   "bc146287841851768ff6040e5fbc1d829677413e",
+   "7de044c48d604dda57553267f6247fa2926a2316",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-010.html": [
-   "2fe23a2f58c96b29b8741e35ca77b856431c5d19",
+   "fc5cfbb40c6610126e402487cda944934c266a1b",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-011.html": [
-   "83b810467e538bb0b8982224e2008aef0f48e84a",
+   "e7bd2ef62d02b104e0df649945ca59a5fca930bf",
    "reftest"
   ],
   "css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-012.html": [
-   "1b2f571a79fe01b247ade6d6ea8514c7b46e2fd6",
+   "dc9d15b18538afb38790de51e31095ce9f93e0a9",
    "reftest"
   ],
   "css/css-grid-1/grid-definition/fr-unit-with-percentage.html": [
@@ -224559,6 +224637,14 @@
    "d33a4338262c5fec8f3739eb743ff5945743c635",
    "support"
   ],
+  "css/css-tables-3/fixed-layout-excess-width-distribution-001-expected.txt": [
+   "a4c3d95f4339d0303dd5baf70b3202ac59a0900f",
+   "support"
+  ],
+  "css/css-tables-3/fixed-layout-excess-width-distribution-001.html": [
+   "36b7b7893dba1f3ddc2edf46fee323d75e5af49d",
+   "testharness"
+  ],
   "css/css-tables-3/floats/floats-wrap-bfc-006b-ref.xht": [
    "22f5ec058d34dc57c010bca8a301eaa8f7901880",
    "support"
@@ -224579,6 +224665,10 @@
    "abe7468e88cad3aef32c7e59fa4a33a7930ef53b",
    "support"
   ],
+  "css/css-tables-3/support/check-layout-th.js": [
+   "a9d8444db24ab38518f07a965a8a537cc6add437",
+   "support"
+  ],
   "css/css-tables-3/visibility-collapse-col-001.html": [
    "3e3661a3b8b8d6d42cf5aaa982f6a75902803767",
    "testharness"
@@ -230000,7 +230090,7 @@
    "testharness"
   ],
   "css/css-ui-3/caret-color-020.html": [
-   "ccb5ab72ef95d82eba7504f26170a88a98178edd",
+   "46c6575138d57250aa385e2ee5fa4a8453da644e",
    "testharness"
   ],
   "css/css-ui-3/caret-color-021.html": [
@@ -231572,7 +231662,7 @@
    "reftest"
   ],
   "css/css-ui-3/text-overflow-006.html": [
-   "f52b6fb409dac90a71fa71c201d0b8c08d805fbd",
+   "f1cf60e25fd70476597cd86cd81ebeea6a5586a3",
    "reftest"
   ],
   "css/css-ui-3/text-overflow-007.html": [
@@ -232208,11 +232298,11 @@
    "support"
   ],
   "css/css-values-3/reference/vh_not_refreshing_on_chrome-ref.html": [
-   "214ac04a1caed95fff6854c18a7fae9ffdca1b76",
+   "affece13e73e451198a986146abde869b90c64cb",
    "support"
   ],
   "css/css-values-3/reference/vh_not_refreshing_on_chrome_iframe-ref.html": [
-   "ad8d37ad73e28b91af8b469eac6eab2bc0bdb9ef",
+   "81474dbdd159353cc30131e37d54556e422e3f5a",
    "support"
   ],
   "css/css-values-3/support/1x1-green.png": [
@@ -232392,7 +232482,7 @@
    "support"
   ],
   "css/css-values-3/support/vh_not_refreshing_on_chrome_iframe.html": [
-   "bdb7025d19780a35e031e5b4df92a0e3b2ec815d",
+   "95f9582bf94c0bc60ddee79415b763af8762faf0",
    "support"
   ],
   "css/css-values-3/unset-value-storage.html": [
@@ -232452,7 +232542,7 @@
    "support"
   ],
   "css/css-values-3/vh_not_refreshing_on_chrome.html": [
-   "50f44774467976bc31f0d05df882bc971375991d",
+   "b95d1e9054aaaa9c9a780fd4852307ed3604d46a",
    "reftest"
   ],
   "css/css-values-3/viewport-relative-lengths-scaled-viewport.html": [
@@ -241599,6 +241689,22 @@
    "bf1c490777f450275a95ecfc6d6d2c0d055aca82",
    "testharness"
   ],
+  "cssom-view/elementFromPoint-002-expected.txt": [
+   "175d1f8985e5d3c1aee4150a11b8082a003f2f79",
+   "support"
+  ],
+  "cssom-view/elementFromPoint-002.html": [
+   "36d7e75021f7f6ab8f89b2654ba3c8f818af16b8",
+   "testharness"
+  ],
+  "cssom-view/elementFromPoint-003-expected.txt": [
+   "51b659dcd9106a5e569e0f6827c61d14aaf054b4",
+   "support"
+  ],
+  "cssom-view/elementFromPoint-003.html": [
+   "a689737bd60877e181a8a7ff27774ab383c3de0b",
+   "testharness"
+  ],
   "cssom-view/elementFromPoint.html": [
    "0f78405640523cf451b19ea0348b8216139b8168",
    "testharness"
@@ -242188,11 +242294,11 @@
    "support"
   ],
   "cssom/stylesheet-same-origin.sub-expected.txt": [
-   "ae090f3f5af4d5e0e53a11f49e1ca790ce8241e8",
+   "792fa7c35a9a21318d124516d07ce53cf6ff1cd8",
    "support"
   ],
   "cssom/stylesheet-same-origin.sub.html": [
-   "719c525b1af3b6b46dfeeb0627034d799bab50b5",
+   "c8112887da9ee152a9ebe64988fd29cb2c27b9ba",
    "testharness"
   ],
   "cssom/support/1x1-green.png": [
@@ -246888,7 +246994,7 @@
    "support"
   ],
   "fetch/api/abort/general.any.js": [
-   "825ca882bce4fe9f231c29d44cc820ae8158b330",
+   "784c14c7fd5a605d380584aeefb35392579f21d9",
    "testharness"
   ],
   "fetch/api/abort/general.any.worker-expected.txt": [
@@ -247207,8 +247313,12 @@
    "6ccdfba06f9a8692029d72ef81aee16a1996ca01",
    "testharness"
   ],
+  "fetch/api/headers/headers-record-expected.txt": [
+   "22f7a26bd5457081904642b8375756cc58512c13",
+   "support"
+  ],
   "fetch/api/headers/headers-record.html": [
-   "84652a79c8ff64826faff6151cf4a48450e706d1",
+   "25ab8a6a8988b529c7023ed50a62f0ac46e20b8e",
    "testharness"
   ],
   "fetch/api/headers/headers-structure.html": [
@@ -247688,7 +247798,7 @@
    "support"
   ],
   "fetch/api/resources/utils.js": [
-   "1027bd5e728ae008520ce151722760dbb53a2368",
+   "d9e65bbd408a906a4d14aa40d4ed20ea2ed9f585",
    "support"
   ],
   "fetch/api/response/multi-globals/current/current.html": [
@@ -247727,12 +247837,8 @@
    "a9606b70a21e24dde0da19656773fc0c60fa255f",
    "testharness"
   ],
-  "fetch/api/response/response-consume-stream-expected.txt": [
-   "31b9a1f39d959c5621473ee7aca9cf0de6a6b602",
-   "support"
-  ],
   "fetch/api/response/response-consume-stream.html": [
-   "dad05becbd8f3944aa3709ae1a3e578c05d4d935",
+   "7e990d212ef225ac8475803e01b1772086dbc08d",
    "testharness"
   ],
   "fetch/api/response/response-consume.html": [
@@ -248348,7 +248454,7 @@
    "testharness"
   ],
   "hr-time/timeOrigin.html": [
-   "f07da265bb9d1036589ff116b14ea1370abc4194",
+   "f2258619e00dd12ee38958bf251c72acab60baa2",
    "testharness"
   ],
   "hr-time/timing-attack.html": [
@@ -250292,7 +250398,7 @@
    "support"
   ],
   "html/browsers/origin/origin-of-data-document.html": [
-   "360415417ed0dadfaf947954fbd0cf801dbd5bdc",
+   "9fec457691ac4b071e9bc8de1ebf6f13dbadd4e5",
    "testharness"
   ],
   "html/browsers/origin/relaxing-the-same-origin-restriction/.gitkeep": [
@@ -258375,6 +258481,10 @@
    "cdcd861169c580a2ddae38b61cbbcd6efe1c5064",
    "testharness"
   ],
+  "html/semantics/document-metadata/the-style-element/style_type_change.html": [
+   "867064126601c92dce8a61d6f3e8237153a0a583",
+   "testharness"
+  ],
   "html/semantics/document-metadata/the-title-element/.gitkeep": [
    "da39a3ee5e6b4b0d3255bfef95601890afd80709",
    "support"
@@ -261172,7 +261282,7 @@
    "support"
   ],
   "html/semantics/scripting-1/the-script-element/module/errorhandling.html": [
-   "ffd411f153c55abf313fba5ab349b6a0cc50ba0f",
+   "10ccf68924459d54784ebc9cfdcdad21cb20811e",
    "testharness"
   ],
   "html/semantics/scripting-1/the-script-element/module/evaluation-error-1.html": [
@@ -262003,6 +262113,10 @@
    "6be1e4a40962036b4fc0a300e8b13a082b391713",
    "manual"
   ],
+  "html/semantics/selectors/pseudo-classes/checked-type-change.html": [
+   "3ac87c477fd16cfc944b19c7e843fe0a61c84c20",
+   "testharness"
+  ],
   "html/semantics/selectors/pseudo-classes/checked.html": [
    "b5790716eff3f91ac04f78e669bfacac4ede5642",
    "testharness"
@@ -262055,10 +262169,18 @@
    "e20ded9d68245b887923a0cc14f6d46bc34fd809",
    "testharness"
   ],
+  "html/semantics/selectors/pseudo-classes/indeterminate-type-change.html": [
+   "490ebd95eca88e917baf5550015af18ab8de5c34",
+   "testharness"
+  ],
   "html/semantics/selectors/pseudo-classes/indeterminate.html": [
    "d4a60c5c7e3a3fbf16e87d347856b27a731a8820",
    "testharness"
   ],
+  "html/semantics/selectors/pseudo-classes/inrange-outofrange-type-change.html": [
+   "ef8776ed618df10937a704b154a1adfea351ac76",
+   "testharness"
+  ],
   "html/semantics/selectors/pseudo-classes/inrange-outofrange.html": [
    "8bcc8d0d7997c2bd55d66e816741ec4a9651dec7",
    "testharness"
@@ -264291,10 +264413,6 @@
    "72ad817fc93645a5d507fb6ce7b4892d9ee903e3",
    "testharness"
   ],
-  "imagebitmap/createImageBitmap-invalid-args.html": [
-   "e839d537057d03f55108b871d2d32272cac7bc7f",
-   "testharness"
-  ],
   "images/OWNERS": [
    "bdefdf4bd84d02d2bff2eb4f48f0d54e6155d248",
    "support"
@@ -264435,6 +264553,10 @@
    "44481e3f374d75b735ac01ae83dc8ed9330238fc",
    "support"
   ],
+  "images/smiley.png.headers": [
+   "4f956a2d550f09444239d1c0bc640200a3c60102",
+   "support"
+  ],
   "images/threecolors.png": [
    "3c394b0d754a7b02514b46d5483a0014d5dcdca6",
    "support"
@@ -264672,7 +264794,7 @@
    "testharness"
   ],
   "intersection-observer/timestamp.html": [
-   "b9bf8d472d7751ec4a1ebee925d12668bedeee7a",
+   "0d57a6abc3c3056f921401f629ab231c458cf4cb",
    "testharness"
   ],
   "intersection-observer/unclipped-root.html": [
@@ -266943,10 +267065,6 @@
    "6a0548ef4b906e539d89940aa791a78bba905262",
    "support"
   ],
-  "mixed-content/imageset.https.sub-expected.txt": [
-   "2f7ce080c9a4cff851f8ebaa425805fb83652a06",
-   "support"
-  ],
   "mixed-content/imageset.https.sub.html": [
    "e2005b813384f38b64baec9bc431e25aa61f417f",
    "testharness"
@@ -282640,7 +282758,7 @@
    "support"
   ],
   "resource-timing/resources/gzip_xml.py": [
-   "dfddf3eb3e80d77163ae12a5df71ed3e9559722a",
+   "cf637a4389fd259dee3a2df56194a68b3744b4c6",
    "support"
   ],
   "resource-timing/resources/iframe_TAO_match_origin.html": [
@@ -282715,10 +282833,6 @@
    "e23e9cab8d42a3bb6b0635cd3916d9131ccc6ba2",
    "testharness"
   ],
-  "resource-timing/test_resource_timing-expected.txt": [
-   "ce12b8628e7462773b56e3e8b32f5049349931ea",
-   "support"
-  ],
   "resource-timing/test_resource_timing.html": [
    "16c8af27032f9babbc6b5443a033a44d5597ff1e",
    "testharness"
@@ -283080,7 +283194,7 @@
    "testharness"
   ],
   "selection/removeAllRanges.html": [
-   "bd203d8878c4de59de476fe6fa7417bd2678dfcc",
+   "c1ed8afc2f1ee80f5131d1ead6930c9895a2a6f3",
    "testharness"
   ],
   "selection/removeRange-expected.txt": [
@@ -288028,7 +288142,7 @@
    "support"
   ],
   "web-animations/animation-model/animation-types/property-types.js": [
-   "80be6cea9cc4d5986abbdf2823e013b8e5b4bcab",
+   "f7947653d8668f236117913217d808e690476059",
    "support"
   ],
   "web-animations/animation-model/combining-effects/effect-composition-expected.txt": [
@@ -289604,7 +289718,7 @@
    "testharness"
   ],
   "webrtc/RTCPeerConnection-setRemoteDescription.html": [
-   "2f559e3c29b05771159203adc584f6d6813e1542",
+   "3fa920f546dbb273634a25adf578e9489debb3b5",
    "testharness"
   ],
   "webrtc/RTCPeerConnectionIceEvent-constructor-expected.txt": [
@@ -290983,6 +291097,10 @@
    "56b3c331a13ef832f9aa1721839516bf96e0eda8",
    "support"
   ],
+  "webstorage/resources/storage_session_window_noopener_second.html": [
+   "56743e7c12f266463dface58439ab5f2a644a802",
+   "support"
+  ],
   "webstorage/resources/storage_session_window_open_second.html": [
    "828dee748950bef2094afc43b0f9db8c3a655acb",
    "support"
@@ -291055,6 +291173,14 @@
    "16420690823c36d08a83656746a0f05324602036",
    "testharness"
   ],
+  "webstorage/storage_session_window_noopener-expected.txt": [
+   "150e21458c6624c1cb398d349ceb5185e83292e5",
+   "support"
+  ],
+  "webstorage/storage_session_window_noopener.html": [
+   "386af726f84fac19f96d64420c53927cd548f88b",
+   "testharness"
+  ],
   "webstorage/storage_session_window_open.html": [
    "86f5002f1c0e22234928673465cc4317b6d599f5",
    "testharness"

diff --git a/third_party/WebKit/LayoutTests/external/wpt/imagebitmap/createImageBitmap-invalid-args.html b/third_party/WebKit/LayoutTests/external/wpt/2dcontext/imagebitmap/createImageBitmap-invalid-args.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/external/wpt/imagebitmap/createImageBitmap-invalid-args.html
rename to third_party/WebKit/LayoutTests/external/wpt/2dcontext/imagebitmap/createImageBitmap-invalid-args.html


diff --git a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send-expected.txt
index 7b9dd0af..983f810 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send-expected.txt

@@ -1,4 +1,4 @@
 This is a testharness.js-based test.
-FAIL XMLHttpRequest: abort() after send() assert_equals: expected "upload.abort(0,0,false)" but got "upload.progress(0,0,false)"
+FAIL XMLHttpRequest: abort() after send() assert_equals: expected "abort(0,0,false)" but got "upload.progress(0,0,false)"
 Harness: the test ran to completion.
 

diff --git a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send.htm b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send.htm
index aa4632f1..523a0d6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send.htm
+++ b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/abort-after-send.htm

@@ -38,7 +38,7 @@
         client.abort()
         assert_true(control_flag)
         assert_equals(client.readyState, 0)
-        assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "upload.abort(0,0,false)", "upload.loadend(0,0,false)", "abort(0,0,false)", "loadend(0,0,false)"])
+        assert_xhr_event_order_matches([1, "loadstart(0,0,false)", 4, "abort(0,0,false)", "loadend(0,0,false)"])
         test.done()
       })
     </script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/allow-lists-starting-with-comma.htm b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/allow-lists-starting-with-comma.htm
index 03cc7cb8..4a4e5e2 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/allow-lists-starting-with-comma.htm
+++ b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/allow-lists-starting-with-comma.htm

@@ -4,30 +4,30 @@
     <title>Allow lists starting with a comma should be parsed correctly</title>
     <script src="/resources/testharness.js"></script>
     <script src="/resources/testharnessreport.js"></script>
+    <script src="/common/get-host-info.sub.js"></script>
   </head>
   <body>
   <script type="text/javascript">
-    var test = async_test();
-
-    test.step(function() {
-      var xhr = new XMLHttpRequest();
-      var url = "resources/access-control-allow-lists.py?headers=,y-lol,x-print,%20,,,y-print&origin=http://127.0.0.1:8000";
-      xhr.open("GET", url, false);
-      xhr.setRequestHeader('x-print', 'unicorn')
-      xhr.setRequestHeader('y-print', 'narwhal')
+    async_test(function(test) {
+      const client = new XMLHttpRequest();
+      let url = "XMLHttpRequest/resources/access-control-allow-lists.py?headers=,y-lol,x-print,%20,,,y-print&origin=" +
+          get_host_info().HTTP_ORIGIN;
+      client.open("GET", get_host_info().HTTP_REMOTE_ORIGIN + '/' + url, false);
+      client.setRequestHeader('x-print', 'unicorn')
+      client.setRequestHeader('y-print', 'narwhal')
       // Sending GET request with custom headers
-      assert_equals(xhr.send(null), undefined);
-      var response = JSON.parse(xhr.response);
+      assert_equals(client.send(null), undefined);
+      const response = JSON.parse(client.response);
       assert_equals(response['x-print'], "unicorn");
       assert_equals(response['y-print'], "narwhal");
 
-      url = "resources/access-control-allow-lists.py?methods=,,PUT,GET&origin=http://127.0.0.1:8000";
-      xhr.open("PUT", url, false);
+      url = "XMLHttpRequest/resources/access-control-allow-lists.py?methods=,,PUT,GET&origin=" +
+          get_host_info().HTTP_ORIGIN;
+      client.open("PUT", get_host_info().HTTP_REMOTE_ORIGIN + '/' + url, false);
       // Sending PUT request
-      assert_equals(xhr.send(null), undefined);
+      assert_equals(client.send(null), undefined);
       test.done();
-    });
+    }, "Allow lists starting with a comma should be parsed correctly");
   </script>
   </body>
   </html>
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/resources/access-control-allow-lists.py b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/resources/access-control-allow-lists.py
index c020cd2d..526d365 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/resources/access-control-allow-lists.py
+++ b/third_party/WebKit/LayoutTests/external/wpt/XMLHttpRequest/resources/access-control-allow-lists.py

@@ -8,15 +8,13 @@
             response.headers.set("Access-Control-Allow-Origin", request.GET["origin"])
 
     if "headers" in request.GET:
-        response.headers.set("Access-Control-Allow-Headers", '{'+request.GET["headers"]+'}')
+        response.headers.set("Access-Control-Allow-Headers", request.GET["headers"])
     if "methods" in request.GET:
-        response.headers.set("Access-Control-Allow-Methods", '{'+request.GET["methods"]+'}')
+        response.headers.set("Access-Control-Allow-Methods", request.GET["methods"])
 
     headers = dict(request.headers)
 
     for header in headers:
         headers[header] = headers[header][0]
 
-    headers["get_value"] = "" if "get_value" not in request.GET else request.GET["get_value"]
-
     return json.dumps(headers)

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-fonts-3/test_datafont_same_origin.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-fonts-3/test_datafont_same_origin.html
new file mode 100644
index 0000000..937c8c3
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-fonts-3/test_datafont_same_origin.html

@@ -0,0 +1,43 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset=utf-8>
+  <title>data:font same-origin test</title>
+  <link rel="author" title="Henry Chang" href="mailto:hchang@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css-fonts-3/#font-prop" />
+  <meta name="assert" content="tests data:font would be treated same origin." />
+  <script type="text/javascript" src="/resources/testharness.js"></script>
+  <script type="text/javascript" src="/resources/testharnessreport.js"></script>
+  <style type="text/css">
+    @font-face {
+      font-family: 'DataFont';
+      src: url(data:font/opentype;base64,AAEAAAANAIAAAwBQRkZUTU6u6MkAAAXcAAAAHE9TLzJWYWQKAAABWAAAAFZjbWFwAA8D7wAAAcAAAAFCY3Z0IAAhAnkAAAMEAAAABGdhc3D//wADAAAF1AAAAAhnbHlmCC6aTwAAAxQAAACMaGVhZO8ooBcAAADcAAAANmhoZWEIkAV9AAABFAAAACRobXR4EZQAhQAAAbAAAAAQbG9jYQBwAFQAAAMIAAAACm1heHAASQA9AAABOAAAACBuYW1lehAVOgAAA6AAAAIHcG9zdP+uADUAAAWoAAAAKgABAAAAAQAAMhPyuV8PPPUACwPoAAAAAMU4Lm0AAAAAxTgubQAh/5wFeAK8AAAACAACAAAAAAAAAAEAAAK8/5wAWgXcAAAAAAV4AAEAAAAAAAAAAAAAAAAAAAAEAAEAAAAEAAwAAwAAAAAAAgAAAAEAAQAAAEAALgAAAAAAAQXcAfQABQAAAooCvAAAAIwCigK8AAAB4AAxAQIAAAIABgkAAAAAAAAAAAABAAAAAAAAAAAAAAAAUGZFZABAAEEAQQMg/zgAWgK8AGQAAAABAAAAAAAABdwAIQAAAAAF3AAABdwAZAAAAAMAAAADAAAAHAABAAAAAAA8AAMAAQAAABwABAAgAAAABAAEAAEAAABB//8AAABB////wgABAAAAAAAAAQYAAAEAAAAAAAAAAQIAAAACAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhAnkAAAAqACoAKgBGAAAAAgAhAAABKgKaAAMABwAusQEALzyyBwQA7TKxBgXcPLIDAgDtMgCxAwAvPLIFBADtMrIHBgH8PLIBAgDtMjMRIREnMxEjIQEJ6MfHApr9ZiECWAAAAwBk/5wFeAK8AAMABwALAAABNSEVATUhFQE1IRUB9AH0/UQDhPu0BRQB9MjI/tTIyP7UyMgAAAAAAA4ArgABAAAAAAAAACYATgABAAAAAAABAAUAgQABAAAAAAACAAYAlQABAAAAAAADACEA4AABAAAAAAAEAAUBDgABAAAAAAAFABABNgABAAAAAAAGAAUBUwADAAEECQAAAEwAAAADAAEECQABAAoAdQADAAEECQACAAwAhwADAAEECQADAEIAnAADAAEECQAEAAoBAgADAAEECQAFACABFAADAAEECQAGAAoBRwBDAG8AcAB5AHIAaQBnAGgAdAAgACgAYwApACAAMgAwADAAOAAgAE0AbwB6AGkAbABsAGEAIABDAG8AcgBwAG8AcgBhAHQAaQBvAG4AAENvcHlyaWdodCAoYykgMjAwOCBNb3ppbGxhIENvcnBvcmF0aW9uAABNAGEAcgBrAEEAAE1hcmtBAABNAGUAZABpAHUAbQAATWVkaXVtAABGAG8AbgB0AEYAbwByAGcAZQAgADIALgAwACAAOgAgAE0AYQByAGsAQQAgADoAIAA1AC0AMQAxAC0AMgAwADAAOAAARm9udEZvcmdlIDIuMCA6IE1hcmtBIDogNS0xMS0yMDA4AABNAGEAcgBrAEEAAE1hcmtBAABWAGUAcgBzAGkAbwBuACAAMAAwADEALgAwADAAMAAgAABWZXJzaW9uIDAwMS4wMDAgAABNAGEAcgBrAEEAAE1hcmtBAAAAAgAAAAAAAP+DADIAAAABAAAAAAAAAAAAAAAAAAAAAAAEAAAAAQACACQAAAAAAAH//wACAAAAAQAAAADEPovuAAAAAMU4Lm0AAAAAxTgubQ==);
+    }
+  </style>
+</head>
+<body>
+<div id="log"></div>
+<pre id="display"></pre>
+<style type="text/css" id="testbox"></style>
+
+<script type="text/javascript">
+  async_test(function(t) {
+    var text = document.createElement('p');
+    // Cross-domain font will not load according to [1] so we try to apply
+    // data:font to this text and see if the font can be loaded.
+    // [1] https://www.w3.org/TR/css-fonts-3/#same-origin-restriction
+    text.style = 'font-family: DataFont';
+    text.innerHTML = "This text should trigger 'TestFont' to load.";
+    document.body.appendChild(text);
+
+    document.fonts.onloadingdone = function (fontFaceSetEvent) {
+      assert_equals(fontFaceSetEvent.fontfaces.length, 1, "Same origin font should be loaded.");
+      t.done();
+    };
+    document.fonts.onloadingerror = function (fontFaceSetEvent) {
+      assert_unreached("data:font is not same origin!");
+    };
+  }, "Test if data:font would be treated same origin.")
+</script>
+</body>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-001.html
index f8aa1c9b7..7b53a28 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-001.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-001.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-002.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-002.html
index d273c7b..194934bb 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-002.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-002.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-003.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-003.html
index b5cf8c0..ed6e322 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-003.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-003.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-004.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-004.html
index a2e4930..419d0fb 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-004.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-004.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-005.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-005.html
index 0b544ff1..2830aeca 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-005.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-005.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution default value</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-006.html
index 7cb2bc1..61cfe2b6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-006.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' and gaps on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-007.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-007.html
index 34faa747..d4dce5d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-007.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-007.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-008.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-008.html
index f2a3f5d..3e381ec 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-008.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-008.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' and gaps on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-009.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-009.html
index 2acad9d..aa28a980 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-009.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-009.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-010.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-010.html
index cc80076..cb08775c 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-010.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-010.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' and gaps on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-011.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-011.html
index c5ef6d7..57eb3d0e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-011.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-011.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' and gaps on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-012.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-012.html
index 2b41ea26..e45dbec8f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-012.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-012.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-013.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-013.html
index 1160cb7a..3e1df650 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-013.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-013.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' and gaps on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-014.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-014.html
index 2d8d24ab..423aad1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-014.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-014.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-015.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-015.html
index f754528c..ef4c857 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-015.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-015.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' and gaps on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-016.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-016.html
index b372aae..11a6691 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-016.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-016.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' and gaps on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-017.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-017.html
index 6155df7..9a490ad9 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-017.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-017.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-019.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-019.html
index 2941b75..49ca22e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-019.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-019.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-020.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-020.html
index da5773b..249f57d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-020.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-020.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' and gaps on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-021.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-021.html
index 0f3bb84..6a5469fc 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-021.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-021.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' and gaps on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-022.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-022.html
index e660c2fe..15a69c11 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-022.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-022.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-023.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-023.html
index 011e4436..f5d07b7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-023.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-023.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' and gaps on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-024.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-024.html
index 73ae83f5..1b6932b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-024.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-024.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-025.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-025.html
index 1909192..f229a56f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-025.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-025.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' and gaps on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-stretch">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-001.html
index 72571da..ebd169c 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-001.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-001.html

@@ -2,9 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' with collapsed tracks on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#distribution-values">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'space-evenly'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-002.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-002.html
index 7fd26610..a48c377 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-002.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-002.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' with collapsed tracks on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'space-between'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-003.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-003.html
index f0100c0..25c0302 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-003.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-003.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' with collapsed tracks on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'space-around'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-004.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-004.html
index d8b43b64..a280a698 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-004.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-004.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' with collapsed tracks on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'stretch'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-005.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-005.html
index d2a323e..34d6211 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-005.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-005.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' and gaps on 2x2 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-evenly' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-006.html
index ce3cbaf..151d34d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-006.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' on 3x3 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-evenly' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-007.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-007.html
index 2e6a4af..061e93b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-007.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-007.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' and gaps on 3x3 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-evenly' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-008.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-008.html
index b299552..1b7135e7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-008.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-008.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' on 4x4 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-evenly' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-009.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-009.html
index 0eb19a3b..0bc4ada 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-009.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-009.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-evenly' and gaps on 4x4 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-evenly">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-evenly' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-010.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-010.html
index 16783fd..eccf0041 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-010.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-010.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' and gaps on 2x2 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-between' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-011.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-011.html
index 7ba130a..fca4df5 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-011.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-011.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' on 3x3 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-between' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-012.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-012.html
index 0eb6c84..4250c14 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-012.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-012.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' and gaps on 3x3 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-between' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-013.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-013.html
index 1f70083..f20741e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-013.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-013.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' on 4x4 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-between' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-014.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-014.html
index 8654369..78d2477 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-014.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-014.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-between' and gaps on 4x4 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-between">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-between' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-015.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-015.html
index 9d7be684..e8247e0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-015.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-015.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' and gaps on 2x2 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-around' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-016.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-016.html
index bbaad00..511961f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-016.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-016.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' on 3x3 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-around' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-017.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-017.html
index ec2ea308..f58730159 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-017.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-017.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' and gaps on 3x3 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-around' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-018.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-018.html
index 93ba652..d91c1c5 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-018.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-018.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' on 4x4 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-around' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-019.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-019.html
index 484ca20c..7a09ce6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-019.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-019.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'space-around' and gaps on 4x4 grid with collapsed tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-align-3/#valdef-align-content-space-around">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">
 <meta name="assert" content="Content Distribution properties with 'space-around' value render correcly.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-020.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-020.html
index 7e9988c..f0a29e7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-020.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-020.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' with collapsed tracks on 2x2 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'stretch'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-021.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-021.html
index 1c8cf66f..d45f528 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-021.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-021.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' with collapsed tracks on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'stretch'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-022.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-022.html
index 3b9a208..7f837ba 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-022.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-022.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' and gaps with collapsed tracks on 3x3 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'stretch'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-023.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-023.html
index b39ea2c..11de67a0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-023.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-023.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' with collapsed tracks on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-200px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'stretch'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-024.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-024.html
index 97d9540..9afd058 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-024.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-content-distribution-with-collapsed-tracks-024.html

@@ -2,8 +2,9 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Content Distribution 'stretch' and gaps with collapsed tracks on 4x4 grid</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#grid-align">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#collapsed-track">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#content-distribution">
-<link rel="help" href="https://drafts.csswg.org/css-grid/#collapsed-track">
 <link rel="match" href="../../reference/ref-filled-green-300px-square.html">
 <meta name="assert" content="Content Distribution alignment ignore collapsed grid tracks and render correctly with a value of 'stretch'.">
 <style>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-001.html
index b25b4713..e700587 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-001.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-001.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-002.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-002.html
index b9a354e..30413e0bb 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-002.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-002.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-003.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-003.html
index 0af4081..63ab28e7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-003.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-003.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-004.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-004.html
index ad76f52..6566e9c1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-004.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-004.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-005.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-005.html
index 68e794bd..1689032 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-005.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-005.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-006.html
index 94c65d0..c090ef8 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-006.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-007.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-007.html
index 8cb459ed9..8a5161ce 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-007.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-007.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-008.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-008.html
index 52337ee..d103a448 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-008.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-008.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-009.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-009.html
index 22bcc707..f971ddb 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-009.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-009.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-010.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-010.html
index 02e138e..1541a27a 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-010.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-010.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-011.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-011.html
index 060e025..dc2738b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-011.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-011.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-012.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-012.html
index 422d2eb0..1c04de1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-012.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-012.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-013.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-013.html
index ba88de0..d8acd61 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-013.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-013.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-014.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-014.html
index 9b3d64d..0b048089 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-014.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-014.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-015.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-015.html
index c7290f7c..dc366eb 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-015.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-015.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-016.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-016.html
index 1365b709..27dab09b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-016.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-016.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-001.html
index ac300a5..5c057624 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-001.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-001.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-002.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-002.html
index 00e4ca7..abcf06e3 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-002.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-002.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-003.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-003.html
index dd96194..ca185bd 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-003.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-003.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-004.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-004.html
index 8b5882c..bc0b8d6c 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-004.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-004.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-005.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-005.html
index 4b29aa7c..b155f5c7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-005.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-005.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-006.html
index a72fbd13..23ee979 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-006.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-007.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-007.html
index ab190d39..5496e781 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-007.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-007.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-008.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-008.html
index 5be8653..556ca0f1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-008.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-008.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-009.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-009.html
index f38ceb6a..75433ad 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-009.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-009.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-010.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-010.html
index 6744c05..7ed26cf 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-010.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-010.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-011.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-011.html
index fa50dff..701d9a8 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-011.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-011.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-012.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-012.html
index 94773382..323ad98 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-012.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-012.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-013.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-013.html
index 25baada..dde2a18e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-013.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-013.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-014.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-014.html
index 19a8ede..2a80035 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-014.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-014.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-015.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-015.html
index 45c8b75..34e501f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-015.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-015.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-016.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-016.html
index 2a47e02..5cc5a02 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-016.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-lr-016.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-001.html
index 1afde93..28a7830 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-001.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-001.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-002.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-002.html
index a7a1c97..297b5ff 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-002.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-002.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-003.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-003.html
index 96cbad3..e958ec26 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-003.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-003.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-004.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-004.html
index c93b7b6..ef2a7e6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-004.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-004.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-005.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-005.html
index 73f7a6f..c512afe 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-005.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-005.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-006.html
index 0a6d003f..584bfb9 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-006.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-007.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-007.html
index ac92314..257de49 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-007.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-007.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-008.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-008.html
index 4756ebad..4e9c264f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-008.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-008.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on fixed-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-009.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-009.html
index 4d05c9f..cb66f61 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-009.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-009.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-010.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-010.html
index 1cb5b8dc7..b551d3e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-010.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-010.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-011.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-011.html
index 535d57c..a56e83a2 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-011.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-011.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-012.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-012.html
index 8ed59c7..91c8ce6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-012.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-012.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-013.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-013.html
index 4070c2e..20eafb78 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-013.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-013.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-014.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-014.html
index d6a6b30..61038b2 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-014.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-014.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-015.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-015.html
index e6ef67df..3cadf7f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-015.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-015.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-016.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-016.html
index 5e26d140..03d6f7d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-016.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/grid-self-alignment-stretch-vertical-rl-016.html

@@ -2,9 +2,11 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Alignment and stretch on auto-sized tracks</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#alignment">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#propdef-justify-self">
 <link rel="help" href="https://drafts.csswg.org/css-align/#valdef-justify-self-stretch">
+<link rel="help" href="https://drafts.csswg.org/css-align/#valdef-align-self-stretch">
 <meta name="assert" content="The stretched orthogonal grid items along the column and/or row axis include their defined padding-box.">
 <style>
 .grid {

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-001.html
index 7660c08d..a7d690631 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-001.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-001.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area height</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#column-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-002.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-002.html
index 1e7138c9..48956dd 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-002.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-002.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area height</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#column-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-003.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-003.html
index ce81285c..e4ea440 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-003.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-003.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area height</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#column-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-004.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-004.html
index 0dc218c..5730701b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-004.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-004.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area height</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#column-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-005.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-005.html
index 8570e7d1..63057b22c 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-005.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-005.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area height</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#column-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-006.html
index 0b298a1..4e0eae4 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-006.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area height</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#column-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-007.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-007.html
index a91395e6..6fcd356 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-007.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-007.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area width</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#row-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-008.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-008.html
index a707160..9aee9b3 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-008.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-008.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area width</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#row-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-009.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-009.html
index 67f421f..155a20c07 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-009.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-009.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area width</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#row-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-010.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-010.html
index 366cebb..6333bf3 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-010.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-010.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area width</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#row-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-011.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-011.html
index 5b407583c..4f54208 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-011.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-011.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area width</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#row-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-012.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-012.html
index d3b1274..db7d45e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-012.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-grid-1/alignment/self-baseline/grid-self-baseline-changes-grid-area-size-012.html

@@ -2,6 +2,7 @@
 <meta charset="utf-8">
 <title>CSS Grid Layout Test: Self-Baseline alignment may change grid area width</title>
 <link rel="author" title="Javier Fernandez Garcia-Boente" href="mailto:jfernandez@igalia.com">
+<link rel="help" href="https://drafts.csswg.org/css-grid-1/#row-align">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#baseline-align-self">
 <link rel="help" href="https://drafts.csswg.org/css-align-3/#align-by-baseline">
 <link rel="match" href="../../../reference/ref-filled-green-100px-square.xht">

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-tables-3/fixed-layout-calc-width-001.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-tables-3/fixed-layout-calc-width-001.html
new file mode 100644
index 0000000..91c665e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-tables-3/fixed-layout-calc-width-001.html

@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/check-layout-th.js"></script>
+<link rel="author" title="David Grogan" href="dgrogan@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-tables-3/#distributing-width-to-columns">
+
+<style>
+table {
+  width: 200px;
+  border-collapse: collapse;
+  table-layout: fixed;
+  height: 20px;
+}
+
+td {
+  padding: 0px;
+  background: lime;
+  outline: 1px solid blue;
+}
+</style>
+
+<h2>Calc width on col is treated as auto, even in fixed tables</h2>
+
+<table id=theTable>
+  <col style="width:calc(20% + 80px)">
+  <tr>
+    <td data-expected-width=100></td>
+    <td data-expected-width=100></td>
+  </tr>
+</table>
+
+<script>
+checkLayout('#theTable')
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/caret-color-020.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/caret-color-020.html
index 4e80c2f1..742c4a1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/caret-color-020.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/caret-color-020.html

@@ -33,7 +33,14 @@
         var player = textarea.animate(keyframes, options);
         player.pause();
         player.currentTime = 5;
-        assert_equals(getComputedStyle(textarea).caretColor, 'rgb(128, 128, 128)');
+        var rgb = getComputedStyle(textarea).caretColor.match(/\d+/g);
+        /* Only testing that the rgb value is some intermediary value,
+           but not checking which, as we only care that the value is interpolated,
+           not about the numerical accuracy of interpolation,
+           which is something tests for the animation spec ought to worry about. */
+        assert_true( rgb[0] < 255 && rgb[0] > 0, "the red channel is interpolated");
+        assert_true( rgb[1] < 255 && rgb[1] > 0, "the green channel is interpolated");
+        assert_true( rgb[2] < 255 && rgb[2] > 0, "the blue channel is interpolated");
       }, "caret-color: currentcolor is interpolable");
 </script>
 </body>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/text-overflow-006.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/text-overflow-006.html
index 0da8e962..f978f62 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/text-overflow-006.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-ui-3/text-overflow-006.html

@@ -5,27 +5,24 @@
 <link rel="help" href="http://www.w3.org/TR/css3-ui/#text-overflow">
 <link rel="match" href="reference/text-overflow-006-ref.html">
 <meta name="flags" content="">
-<meta name="assert" content="Checks that the elipsis is applied at the edge of the block container, not the end of the line box, when these are different.">
+<meta name="assert" content="Checks that the elipsis is applied at the edge of the line box, not the end of the block container, when these are different.">
 <style>
 div {
   white-space: pre;
   font-family: monospace;
   text-overflow: ellipsis;
   overflow: hidden;
-  width: calc(5ch + 1px);
-  /* 5ch ought to be enough,
-     but Safari seems to have aliasing issues that make the ellipsis character larger than 1ch by a fraction of a pixel.
-     Adding an extra 1px does not change the validity of the test,
+  width: 9.5ch;
+  /* 9ch ought to be enough,
+     but Safari seems to have aliasing issues that make the ellipsis character larger than 1ch by a bit.
+     Adding an extra .5 does not change the validity of the test,
      and lets safari fit “PASS…” in the space provided.
      This issue may be a bug, but if so, it is unrelated to what this test is testing,
      so no need to force a fail when an easy workaround is available.
-
-     NB: At the time of writing, Safari fails the test anyway,
-     but I want to make it possible for it to pass just by fixing what is relevant to CSS-UI.
    */
 }
 span { float: right; }
 </style>
 
 <p>Test passes if “PASS…” appears below.</p>
-<div><span>    </span>PASSfiller text to make things overflow</div>
+<div><span>    </span>PASS FAIL</div>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-002-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-002-expected.txt
new file mode 100644
index 0000000..84331f9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-002-expected.txt

@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+FAIL Checking whether dynamic changes to visibility interact correctly with
+  table anonymous boxes assert_equals: Should hit the overlay first. expected Element node <div id="overlay"><div></div></div> but got Element node <div id="target">Some text</div>
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-002.html b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-002.html
new file mode 100644
index 0000000..ebab52f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-002.html

@@ -0,0 +1,40 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Checking whether dynamic changes to visibility interact correctly with
+  table anonymous boxes</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<style>
+#overlay {
+  display: table;
+  position: absolute;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  background: white;
+  z-index: 999
+}
+
+#wrapper { position: relative; }
+</style>
+<div id=log></div>
+<div id="wrapper">
+  <div id="overlay"><div></div></div>
+  <div id="target">Some text</div>
+</div>
+<script>
+  test(function() {
+    var t = document.querySelector("#target");
+    var rect = t.getBoundingClientRect();
+    var hit = document.elementFromPoint(rect.x + rect.width/2,
+                                        rect.y + rect.height/2);
+    assert_equals(hit, t.previousElementSibling,
+                  "Should hit the overlay first.");
+    t.previousElementSibling.style.visibility = "hidden";
+    hit = document.elementFromPoint(rect.x + rect.width/2,
+                                    rect.y + rect.height/2);
+    assert_equals(hit, t,
+                  "Should hit our target now that the overlay is hidden.");
+  });
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-003-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-003-expected.txt
new file mode 100644
index 0000000..532b2b5a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-003-expected.txt

@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+FAIL Checking whether dynamic changes to visibility interact correctly with
+  table anonymous boxes assert_equals: Should hit the overlay first. expected Element node <div id="overlay"><div></div><div></div></div> but got Element node <div id="target">Some text</div>
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-003.html b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-003.html
new file mode 100644
index 0000000..0a1ac40
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/elementFromPoint-003.html

@@ -0,0 +1,48 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Checking whether dynamic changes to visibility interact correctly with
+  table anonymous boxes</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<style>
+#overlay {
+  display: table;
+  position: absolute;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  background: white;
+  z-index: 999
+}
+
+#wrapper { position: relative; }
+</style>
+<div id=log></div>
+<div id="wrapper">
+  <div id="overlay"><div></div></div>
+  <div id="target">Some text</div>
+</div>
+<script>
+  test(function() {
+    // Make sure we have boxes constructed already.
+    document.body.offsetWidth;
+    var overlay = document.querySelector("#overlay");
+    overlay.insertBefore(document.createElement("div"), overlay.firstChild);
+    overlay.appendChild(document.createElement("div"));
+    // Make sure we have boxes constructed for those inserts/appends
+    document.body.offsetWidth;
+    overlay.firstChild.nextSibling.remove();
+    var t = document.querySelector("#target");
+    var rect = t.getBoundingClientRect();
+    var hit = document.elementFromPoint(rect.x + rect.width/2,
+                                        rect.y + rect.height/2);
+    assert_equals(hit, t.previousElementSibling,
+                  "Should hit the overlay first.");
+    t.previousElementSibling.style.visibility = "hidden";
+    hit = document.elementFromPoint(rect.x + rect.width/2,
+                                    rect.y + rect.height/2);
+    assert_equals(hit, t,
+                  "Should hit our target now that the overlay is hidden.");
+  });
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub-expected.txt
index 76df1ec..81cc135 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub-expected.txt

@@ -3,5 +3,6 @@
                     crossorigin.cssRules;
                 }" did not throw
 PASS Origin-clean check in same-origin CSSOM Stylesheets
+FAIL Origin-clean check in data:css CSSOM Stylesheets Cannot read property 'length' of null
 Harness: the test ran to completion.
 

diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub.html b/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub.html
index b259e436..9df0a54 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom/stylesheet-same-origin.sub.html

@@ -8,10 +8,12 @@
 
     <link id="crossorigin" href="http://www1.{{host}}:{{ports[http][1]}}/stylesheet-same-origin.css" rel="stylesheet">
     <link id="sameorigin" href="stylesheet-same-origin.css" rel="stylesheet">
+    <link id="sameorigindata" href="data:text/css,.green-text{color:rgb(0, 255, 0)}" rel="stylesheet">
 
     <script>
         var crossorigin = document.getElementById("crossorigin").sheet;
         var sameorigin = document.getElementById("sameorigin").sheet;
+        var sameorigindata = document.getElementById("sameorigindata").sheet;
 
         test(function() {
             assert_throws("SecurityError",
@@ -32,13 +34,22 @@
                 "Cross origin stylesheet.deleteRule should throw SecurityError.");
         }, "Origin-clean check in cross-origin CSSOM Stylesheets");
 
+        function doOriginCleanCheck(sheet, name) {
+            assert_equals(sheet.cssRules.length, 1, name + " stylesheet.cssRules should be accessible.");
+            sheet.insertRule("#test { margin: 10px; }", 1);
+            assert_equals(sheet.cssRules.length, 2, name + " stylesheet.insertRule should be accessible.");
+            sheet.deleteRule(0);
+            assert_equals(sheet.cssRules.length, 1, name + " stylesheet.deleteRule should be accessible.");
+        }
+
         test(function() {
-            assert_equals(sameorigin.cssRules.length, 1, "Same origin stylesheet.cssRules should be accessible.");
-            sameorigin.insertRule("#test { margin: 10px; }", 1);
-            assert_equals(sameorigin.cssRules.length, 2, "Same origin stylesheet.insertRule should be accessible.");
-            sameorigin.deleteRule(0);
-            assert_equals(sameorigin.cssRules.length, 1, "Same origin stylesheet.deleteRule should be accessible.");
+            doOriginCleanCheck(sameorigin, "Same-origin");
         }, "Origin-clean check in same-origin CSSOM Stylesheets");
+
+        test(function() {
+            doOriginCleanCheck(sameorigindata, "data:css");
+        }, "Origin-clean check in data:css CSSOM Stylesheets");
+
     </script>
 </head>
 <body>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/abort/general.any.js b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/abort/general.any.js
index 2bc1578..e2c6e8d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/abort/general.any.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/abort/general.any.js

@@ -320,7 +320,7 @@
     mode: 'no-cors'
   });
 
-  const stashTakeURL = new URL(`../resources/stash-take.py?key=${stateKey}`);
+  const stashTakeURL = new URL(`../resources/stash-take.py?key=${stateKey}`, location);
   stashTakeURL.hostname = 'www1.' + stashTakeURL.hostname;
 
   const beforeAbortResult = await fetch(stashTakeURL).then(r => r.json());

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record-expected.txt
new file mode 100644
index 0000000..3d8190e1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record-expected.txt

@@ -0,0 +1,16 @@
+This is a testharness.js-based test.
+PASS Passing nothing to Headers constructor
+PASS Passing undefined to Headers constructor
+PASS Passing null to Headers constructor
+PASS Basic operation with one property
+PASS Basic operation with one property and a proto
+PASS Correct operation ordering with two properties
+PASS Correct operation ordering with two properties one of which has an invalid name
+PASS Correct operation ordering with two properties one of which has an invalid value
+PASS Correct operation ordering with non-enumerable properties
+PASS Correct operation ordering with undefined descriptors
+FAIL Correct operation ordering with repeated keys assert_throws: function "function () { var h = new Headers(proxy); }" did not throw
+PASS Basic operation with Symbol keys
+PASS Operation with non-enumerable Symbol keys
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record.html b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record.html
index a91b9b5..85dfadd 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/headers/headers-record.html

@@ -251,59 +251,21 @@
     ownKeys: function() {
       return [ "a", "c", "a", "c" ];
     },
-    getCalls: 0,
-    gotCOnce: false,
-    get: function(target, name, receiver) {
-      if (name == "c") {
-        this.gotCOnce = true;
-      }
-      if (typeof name == "string") {
-        return ++this.getCalls;
-      }
-      return Reflect.get(target, name, receiver);
-    },
-    getOwnPropertyDescriptor: function(target, name) {
-      var desc = Reflect.getOwnPropertyDescriptor(target, name);
-      if (name == "c" && this.gotCOnce) {
-        desc.enumerable = false;
-      }
-      return desc;
-    }
   };
   var lyingProxy = new Proxy(record, lyingHandler);
   var proxy = new Proxy(lyingProxy, loggingHandler);
-  var h = new Headers(proxy);
 
-  assert_equals(log.length, 9);
+  // Returning duplicate keys from ownKeys() throws a TypeError.
+  assert_throws(new TypeError(),
+                function() { var h = new Headers(proxy); });
+
+  assert_equals(log.length, 2);
   // The first thing is the [[Get]] of Symbol.iterator to figure out whether
   // we're a sequence, during overload resolution.
   assert_array_equals(log[0], ["get", lyingProxy, Symbol.iterator, proxy]);
   // Then we have the [[OwnPropertyKeys]] from
   // https://heycam.github.io/webidl/#es-to-record step 4.
   assert_array_equals(log[1], ["ownKeys", lyingProxy]);
-  // Then the [[GetOwnProperty]] from step 5.1.
-  assert_array_equals(log[2], ["getOwnPropertyDescriptor", lyingProxy, "a"]);
-  // Then the [[Get]] from step 5.2.
-  assert_array_equals(log[3], ["get", lyingProxy, "a", proxy]);
-  // Then the second [[GetOwnProperty]] from step 5.1.
-  assert_array_equals(log[4], ["getOwnPropertyDescriptor", lyingProxy, "c"]);
-  // Then the second [[Get]] from step 5.2.
-  assert_array_equals(log[5], ["get", lyingProxy, "c", proxy]);
-  // Then the third [[GetOwnProperty]] from step 5.1.
-  assert_array_equals(log[6], ["getOwnPropertyDescriptor", lyingProxy, "a"]);
-  // Then the third [[Get]] from step 5.2.
-  assert_array_equals(log[7], ["get", lyingProxy, "a", proxy]);
-  // Then the fourth [[GetOwnProperty]] from step 5.1.
-  assert_array_equals(log[8], ["getOwnPropertyDescriptor", lyingProxy, "c"]);
-  // No [[Get]] because not enumerable.
-
-  // Check the results.
-  assert_equals([...h].length, 2);
-  assert_array_equals([...h.keys()], ["a", "c"]);
-  assert_true(h.has("a"));
-  assert_equals(h.get("a"), "3");
-  assert_true(h.has("c"));
-  assert_equals(h.get("c"), "2");
 }, "Correct operation ordering with repeated keys");
 
 test(function() {

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/resources/utils.js b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/resources/utils.js
index f290c22..213d01a 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/resources/utils.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/resources/utils.js

@@ -81,6 +81,26 @@
   });
 }
 
+function validateStreamFromPartialString(reader, expectedValue, retrievedArrayBuffer) {
+  return reader.read().then(function(data) {
+    if (!data.done) {
+      assert_true(data.value instanceof Uint8Array, "Fetch ReadableStream chunks should be Uint8Array");
+      var newBuffer;
+      if (retrievedArrayBuffer) {
+        newBuffer =  new ArrayBuffer(data.value.length + retrievedArrayBuffer.length);
+        newBuffer.set(retrievedArrayBuffer, 0);
+        newBuffer.set(data.value, retrievedArrayBuffer.length);
+      } else {
+        newBuffer = data.value;
+      }
+      return validateStreamFromPartialString(reader, expectedValue, newBuffer);
+    }
+
+    var string = new TextDecoder("utf-8").decode(retrievedArrayBuffer);
+    return assert_true(string.search(expectedValue) != -1, "Retrieve and verify stream");
+  });
+}
+
 // From streams tests
 function delay(milliseconds)
 {

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream-expected.txt
deleted file mode 100644
index 1c034b4..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream-expected.txt
+++ /dev/null

@@ -1,12 +0,0 @@
-This is a testharness.js-based test.
-PASS Read empty text response's body as readableStream
-PASS Read empty blob response's body as readableStream
-PASS Read blob response's body as readableStream
-PASS Read text response's body as readableStream
-PASS Read URLSearchParams response's body as readableStream
-PASS Read array buffer response's body as readableStream
-FAIL Read form data response's body as readableStream assert_array_equals: Retrieve and verify stream lengths differ, expected 10 got 140
-PASS Getting an error Response stream
-FAIL Getting a redirect Response stream assert_not_equals: got disallowed value undefined
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream.html b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream.html
index 21424f2a..8a97fa0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/fetch/api/response/response-consume-stream.html

@@ -57,14 +57,15 @@
 
 promise_test(function(test) {
     var response = new Response(formData);
-    return validateStreamFromString(response.body.getReader(), "name=value");
+    return validateStreamFromPartialString(response.body.getReader(),
+      "Content-Disposition: form-data; name=\"name\"\r\n\r\nvalue");
 }, "Read form data response's body as readableStream");
 
 test(function() {
     assert_equals(Response.error().body, null);
 }, "Getting an error Response stream");
 
-promise_test(function(test) {
+test(function() {
     assert_equals(Response.redirect("/").body, null);
 }, "Getting a redirect Response stream");
 

diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/browsers/origin/origin-of-data-document.html b/third_party/WebKit/LayoutTests/external/wpt/html/browsers/origin/origin-of-data-document.html
index cedb251..345a3a6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/html/browsers/origin/origin-of-data-document.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/html/browsers/origin/origin-of-data-document.html

@@ -10,17 +10,28 @@
   <body>
     <script>
       async_test(function (t) {
-        window.addEventListener("message", t.step_func_done(function (e) {
-          assert_equals(e.origin, "null", "Messages sent from a 'data:' URL should have an opaque origin (which serializes to 'null').");
-          assert_throws("SecurityError", function () {
-            var couldAccessCrossOriginProperty = e.source.location.href;
-          }, "The 'data:' frame should be cross-origin.")
-        }));
-
         var i = document.createElement('iframe');
         i.src = "data:text/html,<script>" +
                 "  window.parent.postMessage('Hello!', '*');" +
                 "</scr" + "ipt>";
+
+        window.addEventListener("message", t.step_func_done(function (e) {
+          assert_equals(e.origin, "null", "Messages sent from a 'data:' URL should have an opaque origin (which serializes to 'null').");
+          assert_throws("SecurityError", function () {
+            var couldAccessCrossOriginProperty = e.source.location.href;
+          }, "The 'data:' frame should be cross-origin: 'window.location.href'");
+
+          // Try to access contentDocument of the 'data: ' frame. Some browsers
+          // (i.e. Firefox, Safari) will return |null| and some (i.e. Chrome)
+          // will throw an exception.
+          var dataFrameContentDocument = null;
+          try {
+            dataFrameContentDocument = i.contentDocument;
+          } catch (ex) {
+          }
+          assert_equals(dataFrameContentDocument, null, "The 'data:' iframe should be unable to access its contentDocument.");
+        }));
+
         document.body.appendChild(i);
       }, "The origin of a 'data:' document in a frame is opaque.");
     </script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/document-metadata/the-style-element/style_type_change.html b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/document-metadata/the-style-element/style_type_change.html
new file mode 100644
index 0000000..a19b3c8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/document-metadata/the-style-element/style_type_change.html

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>Dynamically changing HTMLStyleElement.type should change the rendering accordingly</title>
+    <script src="/resources/testharness.js"></script>
+    <script src="/resources/testharnessreport.js"></script>
+    <link rel="help" href="https://html.spec.whatwg.org/multipage/#the-style-element">
+    <style type="no/mime">
+      body { color: green }
+    </style>
+  </head>
+  <body>
+    Text content.
+    <script>
+      var style = document.querySelector("style");
+      test(function() {
+        assert_equals(document.styleSheets.length, 0);
+      }, "Check initial styleSheets length type");
+
+      test(function() {
+        assert_not_equals(getComputedStyle(document.querySelector("body")).color, "rgb(0, 128, 0)");
+        assert_equals(document.styleSheets.length, 0);
+        style.type = "text/css";
+        assert_equals(getComputedStyle(document.querySelector("body")).color, "rgb(0, 128, 0)");
+        assert_equals(document.styleSheets.length, 1);
+      }, "Change type from invalid type to valid type");
+
+      test(function() {
+        assert_equals(getComputedStyle(document.querySelector("body")).color, "rgb(0, 128, 0)");
+        assert_equals(document.styleSheets.length, 1);
+        style.type = "no/mime";
+        assert_not_equals(getComputedStyle(document.querySelector("body")).color, "rgb(0, 128, 0)");
+        assert_equals(document.styleSheets.length, 0);
+      }, "Change type from valid type to invalid type");
+
+    </script>
+  </body>
+</html>
\ No newline at end of file

diff --git a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/module/errorhandling.html b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/module/errorhandling.html
index 6f36d2c..5315df0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/module/errorhandling.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/html/semantics/scripting-1/the-script-element/module/errorhandling.html

@@ -55,7 +55,6 @@
             assert_unreached("This script should not have loaded!");
         }));
         document.body.appendChild(script_wrongMimetype_import);
-
     </script>
 </body>
 </html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/images/smiley.png.headers b/third_party/WebKit/LayoutTests/external/wpt/images/smiley.png.headers
new file mode 100644
index 0000000..7296361
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/images/smiley.png.headers

@@ -0,0 +1 @@
+Timing-Allow-Origin: *

diff --git a/third_party/WebKit/LayoutTests/external/wpt/intersection-observer/timestamp.html b/third_party/WebKit/LayoutTests/external/wpt/intersection-observer/timestamp.html
index 90032560..be198004 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/intersection-observer/timestamp.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/intersection-observer/timestamp.html

@@ -18,28 +18,17 @@
 <div id="trailing-space" class="spacer"></div>
 
 <script>
+// Pick this number to be comfortably greater than the length of two frames at 60Hz.
+var timeSkew = 40;
+
 var topWindowEntries = [];
 var iframeWindowEntries = [];
 var targetIframe;
-var topWindowTimeOnTestStart;
-var topWindowTimeBeforeCreatingIframe;
 var topWindowTimeBeforeNotification;
 var iframeWindowTimeBeforeNotification;
-var timeSkew;
-
-function waitFor(numFrames, callback) {
-  if (numFrames <= 0) {
-    callback();
-    return;
-  }
-  window.requestAnimationFrame(waitFor.bind(null, numFrames - 1, callback));
-}
 
 async_test(function(t) {
-  topWindowTimeOnTestStart = performance.now();
-  waitFor(3, function () {
-    topWindowTimeBeforeCreatingIframe = performance.now();
-    timeSkew = topWindowTimeBeforeCreatingIframe - topWindowTimeOnTestStart;
+  t.step_timeout(function() {
     targetIframe = document.createElement("iframe");
     assert_true(!!targetIframe, "iframe exists");
     targetIframe.src = "resources/timestamp-subframe.html";
@@ -66,7 +55,7 @@
       runTestCycle(step1, "First rAF after iframe is loaded.");
       t.done();
     };
-  });
+  }, timeSkew);
 }, "Check that timestamps correspond to the to execution context that created the observer.");
 
 function step1() {
@@ -84,16 +73,14 @@
   var topWindowTimeAfterNotification = performance.now();
   var iframeWindowTimeAfterNotification = targetIframe.contentWindow.performance.now();
 
-  // Test results are only significant if there's a gap between
-  // top window time and iframe window time.
-  assert_greater_than(topWindowTimeBeforeNotification, iframeWindowTimeAfterNotification,
-    "Time ranges for top and iframe windows are disjoint. Times: " +
-      [topWindowTimeOnTestStart, topWindowTimeBeforeCreatingIframe,
-       topWindowTimeBeforeNotification, topWindowTimeAfterNotification,
-       iframeWindowTimeBeforeNotification, iframeWindowTimeAfterNotification,
-       topWindowEntries[1].time - topWindowTimeBeforeNotification,
-       iframeWindowEntries[1].time - iframeWindowTimeBeforeNotification
-      ]);
+  assert_approx_equals(
+      topWindowEntries[1].time - topWindowTimeBeforeNotification,
+      iframeWindowEntries[1].time - iframeWindowTimeBeforeNotification,
+      // Since all intersections are computed in a tight loop between 2 frames,
+      // an epsilon of 16ms (the length of one frame at 60Hz) turned out to be
+      // reliable, even at slow frame rates.
+      16,
+      "Notification times are relative to the expected time origins");
 
   assert_equals(topWindowEntries.length, 2, "Top window observer has two notifications.");
   assert_between_inclusive(

diff --git a/third_party/WebKit/LayoutTests/external/wpt/mixed-content/imageset.https.sub-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/mixed-content/imageset.https.sub-expected.txt
deleted file mode 100644
index 7e2a1835..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/mixed-content/imageset.https.sub-expected.txt
+++ /dev/null

@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Makes sure imageset blockable resources are not downloaded assert_equals: http://web-platform.test:8001/images/smiley.png?img_src expected 1 but got 0
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/resource-timing/resources/gzip_xml.py b/third_party/WebKit/LayoutTests/external/wpt/resource-timing/resources/gzip_xml.py
index 3346da6c..31a769e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/resource-timing/resources/gzip_xml.py
+++ b/third_party/WebKit/LayoutTests/external/wpt/resource-timing/resources/gzip_xml.py

@@ -1,8 +1,11 @@
 import gzip as gzip_module
 from cStringIO import StringIO
+import os
 
 def main(request, response):
-    f = open('resource-timing/resources/resource_timing_test0.xml', 'r')
+    dir_path = os.path.dirname(os.path.realpath(__file__))
+    file_path = os.path.join(dir_path, 'resource_timing_test0.xml')
+    f = open(file_path, 'r')
     output = f.read()
 
     out = StringIO()

diff --git a/third_party/WebKit/LayoutTests/external/wpt/resource-timing/test_resource_timing-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/resource-timing/test_resource_timing-expected.txt
deleted file mode 100644
index 00de4d9d..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/resource-timing/test_resource_timing-expected.txt
+++ /dev/null

@@ -1,31 +0,0 @@
-This is a testharness.js-based test.
-PASS window.performance.getEntriesByName() and window.performance.getEntriesByNameType() return same data (iframe)
-PASS PerformanceEntry has correct name, initiatorType, startTime, and duration (iframe)
-PASS PerformanceEntry has correct order of timing attributes (iframe)
-PASS PerformanceEntry has correct network transfer attributes (iframe)
-PASS PerformanceEntry has correct protocol attribute (iframe)
-PASS window.performance.getEntriesByName() and window.performance.getEntriesByNameType() return same data (img)
-PASS PerformanceEntry has correct name, initiatorType, startTime, and duration (img)
-PASS PerformanceEntry has correct order of timing attributes (img)
-PASS PerformanceEntry has correct network transfer attributes (img)
-PASS PerformanceEntry has correct protocol attribute (img)
-PASS window.performance.getEntriesByName() and window.performance.getEntriesByNameType() return same data (link)
-PASS PerformanceEntry has correct name, initiatorType, startTime, and duration (link)
-PASS PerformanceEntry has correct order of timing attributes (link)
-PASS PerformanceEntry has correct network transfer attributes (link)
-PASS PerformanceEntry has correct protocol attribute (link)
-PASS window.performance.getEntriesByName() and window.performance.getEntriesByNameType() return same data (script)
-PASS PerformanceEntry has correct name, initiatorType, startTime, and duration (script)
-PASS PerformanceEntry has correct order of timing attributes (script)
-PASS PerformanceEntry has correct network transfer attributes (script)
-PASS PerformanceEntry has correct protocol attribute (script)
-FAIL window.performance.getEntriesByName() and window.performance.getEntriesByNameType() return same data (xmlhttprequest) assert_equals: should have a single entry for each resource (without type) expected 1 but got 0
-FAIL PerformanceEntry has correct name, initiatorType, startTime, and duration (xmlhttprequest) Cannot read property 'name' of undefined
-FAIL PerformanceEntry has correct order of timing attributes (xmlhttprequest) Cannot read property 'connectStart' of undefined
-FAIL PerformanceEntry has correct network transfer attributes (xmlhttprequest) Cannot read property 'encodedBodySize' of undefined
-FAIL PerformanceEntry has correct protocol attribute (xmlhttprequest) Cannot read property 'nextHopProtocol' of undefined
-PASS window.performance Resource Timing Entries exist
-PASS window.performance Resource Timing Entries exist 1
-PASS window.performance Resource Timing Entries exist 2
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/external/wpt/selection/removeAllRanges.html b/third_party/WebKit/LayoutTests/external/wpt/selection/removeAllRanges.html
index 286876f..026280d6 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/selection/removeAllRanges.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/selection/removeAllRanges.html

@@ -13,8 +13,13 @@
 var range = rangeFromEndpoints([paras[0].firstChild, 0, paras[0].firstChild, 1]);
 
 function testRange(rangeDesc, method) {
+    var endpoints = eval(testRanges[i]);
+    if (endpoints.length && (!isSelectableNode(endpoints[0]) ||
+                             !isSelectableNode(endpoints[2]))) {
+      return;
+    }
     test(function() {
-        setSelectionForwards(eval(rangeDesc));
+        setSelectionForwards(endpoints);
         selection[method]();
         assert_equals(selection.rangeCount, 0,
             "After " + method + "(), rangeCount must be 0");
@@ -28,7 +33,7 @@
 
     // Copy-pasted from above
     test(function() {
-        setSelectionBackwards(eval(rangeDesc));
+        setSelectionBackwards(endpoints);
         selection[method]();
         assert_equals(selection.rangeCount, 0,
             "After " + method + "(), rangeCount must be 0");

diff --git a/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/property-types.js b/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/property-types.js
index bbc2411..0ae32779 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/property-types.js
+++ b/third_party/WebKit/LayoutTests/external/wpt/web-animations/animation-model/animation-types/property-types.js

@@ -1540,6 +1540,18 @@
         [{ time: 500,  expected: 'rgb(150, 150, 150) 15px 15px 15px, '
                                + 'rgba(100, 100, 100, 0.5) 5px 5px 5px' }]);
     }, property + ': mismatched list length (from shorter to longer)');
+
+    test(function(t) {
+      var idlName = propertyToIDL(property);
+      var target = createTestElement(t, setup);
+      target.style.color = 'rgb(0, 255, 0)';
+      var animation =
+        target.animate({ [idlName]: [ 'currentcolor 0px 0px 0px',
+                                      'currentcolor 10px 10px 10px'] },
+                       { duration: 1000, fill: 'both' });
+      testAnimationSamples(animation, idlName,
+        [{ time: 500,  expected: 'rgb(0, 255, 0) 5px 5px 5px' }]);
+    }, property + ': with currentcolor');
   },
 
   testAddition: function(property, setup) {
@@ -1649,6 +1661,18 @@
         [{ time: 500,  expected: 'rgb(150, 150, 150) 15px 15px 15px 10px, '
                                + 'rgba(100, 100, 100, 0.5) 5px 5px 5px 0px' }]);
     }, property + ': mismatched list length (from longer to shorter)');
+
+    test(function(t) {
+      var idlName = propertyToIDL(property);
+      var target = createTestElement(t, setup);
+      target.style.color = 'rgb(0, 255, 0)';
+      var animation =
+        target.animate({ [idlName]: [ 'currentcolor 0px 0px 0px 0px',
+                                      'currentcolor 10px 10px 10px 10px'] },
+                       { duration: 1000, fill: 'both' });
+      testAnimationSamples(animation, idlName,
+        [{ time: 500,  expected: 'rgb(0, 255, 0) 5px 5px 5px 5px' }]);
+    }, property + ': with currentcolor');
   },
 
   testAddition: function(property, setup) {

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-setRemoteDescription.html b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-setRemoteDescription.html
index 94e10ded..f01fe08 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-setRemoteDescription.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCPeerConnection-setRemoteDescription.html

@@ -57,7 +57,7 @@
         type: 'bogus',
         sdp: 'bogus'
       }));
-  }, 'setRemoteDescription with invalid type and invalid SDP should reject with TypeError')
+  }, 'setRemoteDescription with invalid type and invalid SDP should reject with TypeError');
 
   promise_test(t => {
     const pc = new RTCPeerConnection();
@@ -68,7 +68,7 @@
         type: 'answer',
         sdp: 'invalid'
       }));
-  }, 'setRemoteDescription() with invalid SDP and stable state should reject with InvalidStateError')
+  }, 'setRemoteDescription() with invalid SDP and stable state should reject with InvalidStateError');
 
   /* Operations after returning to stable state */
 
@@ -79,21 +79,22 @@
     test_state_change_event(t, pc,
       ['have-remote-offer', 'stable', 'have-remote-offer']);
 
-    return generateOffer({ audio: true })
+    return pc2.createOffer({ offerToReceiveAudio: true })
     .then(offer1 =>
       pc.setRemoteDescription(offer1)
       .then(() => pc.createAnswer())
       .then(answer => pc.setLocalDescription(answer))
-      .then(() => generateOffer({ data: true }))
-      .then(offer2 =>
-        pc.setRemoteDescription(offer2)
+      .then(() => pc2.createOffer({ offerToReceiveVideo: true }))
+      .then(offer2 => {
+        return pc.setRemoteDescription(offer2)
         .then(() => {
           assert_equals(pc.signalingState, 'have-remote-offer');
           assert_session_desc_not_equals(offer1, offer2);
           assert_session_desc_equals(pc.remoteDescription, offer2);
           assert_session_desc_equals(pc.currentRemoteDescription, offer1);
           assert_session_desc_equals(pc.pendingRemoteDescription, offer2);
-        })));
+        });
+      }));
   }, 'Calling setRemoteDescription() again after one round of remote-offer/local-answer should succeed');
 
   promise_test(t => {

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webstorage/resources/storage_session_window_noopener_second.html b/third_party/WebKit/LayoutTests/external/wpt/webstorage/resources/storage_session_window_noopener_second.html
new file mode 100644
index 0000000..7e477375
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webstorage/resources/storage_session_window_noopener_second.html

@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>WebStorage Test: sessionStorage - second page</title>
+</head>
+<body>
+<script>
+
+var storage = window.sessionStorage;
+
+var assertions = [];
+
+assertions.push({
+    actual: storage.getItem("FOO"),
+    expected: null,
+    message: "storage.getItem('FOO')"
+});
+
+storage.setItem("FOO", "BAR-NEWWINDOW");
+
+assertions.push({
+    actual: storage.getItem("FOO"),
+    expected: "BAR-NEWWINDOW",
+    message: "value for FOO after changing"
+});
+
+let channel = new BroadcastChannel('storage_session_window_noopener');
+channel.postMessage(assertions, '*');
+
+window.close();
+
+</script>
+</body>
+</html>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webstorage/storage_session_window_noopener-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webstorage/storage_session_window_noopener-expected.txt
new file mode 100644
index 0000000..f7a4f86
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webstorage/storage_session_window_noopener-expected.txt

@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL A new noopener window to make sure there is a not copy of the previous window's sessionStorage assert_equals: storage.getItem('FOO') expected (object) null but got (string) "BAR"
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/external/wpt/webstorage/storage_session_window_noopener.html b/third_party/WebKit/LayoutTests/external/wpt/webstorage/storage_session_window_noopener.html
new file mode 100644
index 0000000..034402f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/webstorage/storage_session_window_noopener.html

@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>WebStorage Test: sessionStorage - open a new window with noopener</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<div id="log"></div>
+<script>
+
+async_test(function(t) {
+
+    var storage = window.sessionStorage;
+    storage.clear();
+
+    storage.setItem("FOO", "BAR");
+
+    let channel = new BroadcastChannel("storage_session_window_noopener");
+    channel.addEventListener("message", t.step_func(function(e) {
+        e.data.forEach(t.step_func(function(assertion) {
+            assert_equals(assertion.actual, assertion.expected, assertion.message);
+        }));
+        assert_equals(storage.getItem("FOO"), "BAR", "value for FOO in original window");
+        t.done();
+    }));
+
+    var win = window.open("resources/storage_session_window_noopener_second.html",
+                          "_blank",
+                          "noopener");
+
+}, "A new noopener window to make sure there is a not copy of the previous window's sessionStorage");
+
+</script>
+</body>
+</html>

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/animated-gif-transformed-offscreen-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/animated-gif-transformed-offscreen-expected.txt
new file mode 100644
index 0000000..68632731
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/animated-gif-transformed-offscreen-expected.txt

@@ -0,0 +1,37 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [2008, 2016],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutBlockFlow DIV id='targetDiv'",
+      "bounds": [50, 50],
+      "transform": 2
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [8, 8, 0, 1]
+      ]
+    },
+    {
+      "id": 2,
+      "parent": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [0, -1000, 0, 1]
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/composited-table-row-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/composited-table-row-expected.txt
new file mode 100644
index 0000000..8feaa04
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/composited-table-row-expected.txt

@@ -0,0 +1,34 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableRow TR",
+      "position": [8, 8],
+      "bounds": [74, 24],
+      "backgroundColor": "#FF0000",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableCell TD id='target'",
+          "rect": [0, 0, 37, 23],
+          "reason": "appeared"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableCell TD id='target'",
+      "reason": "style change"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/compositing/should-not-repaint-composited-transform-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/compositing/should-not-repaint-composited-transform-expected.txt
new file mode 100644
index 0000000..eb5ff27
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/compositing/should-not-repaint-composited-transform-expected.txt

@@ -0,0 +1,37 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutBlockFlow DIV id='composited-box'",
+      "bounds": [102, 102],
+      "transform": 2
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [8, 8, 0, 1]
+      ]
+    },
+    {
+      "id": 2,
+      "parent": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [100, 100, 0, 1]
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/flexbox/repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/flexbox/repaint-expected.txt
new file mode 100644
index 0000000..939f52b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/flexbox/repaint-expected.txt

@@ -0,0 +1,245 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow DIV id='content'",
+          "rect": [138, 128, 654, 100],
+          "reason": "style change"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='content'",
+          "rect": [148, 128, 644, 100],
+          "reason": "style change"
+        },
+        {
+          "object": "InlineTextBox 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean laoreet dolor id urna eleifend aliquet.'",
+          "rect": [137, 128, 637, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'Nulla vel dolor ipsum. Aliquam ut turpis nisl, in vulputate sapien. Cum sociis natoque penatibus et'",
+          "rect": [137, 128, 637, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'Sed volutpat, tellus vel varius vestibulum, purus quam mollis sapien, in condimentum leo neque sed'",
+          "rect": [137, 128, 637, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'magnis dis parturient montes, nascetur ridiculus mus. Sed congue magna vitae dolor feugiat vehicula.'",
+          "rect": [137, 128, 637, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'nulla. Nunc quis porta elit. Pellentesque erat lectus, ultricies a lobortis id, faucibus id quam.'",
+          "rect": [137, 128, 637, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean laoreet dolor id urna eleifend aliquet.'",
+          "rect": [147, 128, 636, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean laoreet dolor id urna eleifend aliquet.'",
+          "rect": [147, 128, 636, 99],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'Nulla vel dolor ipsum. Aliquam ut turpis nisl, in vulputate sapien. Cum sociis natoque penatibus et'",
+          "rect": [147, 128, 636, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'Nulla vel dolor ipsum. Aliquam ut turpis nisl, in vulputate sapien. Cum sociis natoque penatibus et'",
+          "rect": [147, 128, 636, 99],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'Sed volutpat, tellus vel varius vestibulum, purus quam mollis sapien, in condimentum leo neque sed'",
+          "rect": [147, 128, 636, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'Sed volutpat, tellus vel varius vestibulum, purus quam mollis sapien, in condimentum leo neque sed'",
+          "rect": [147, 128, 636, 99],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'magnis dis parturient montes, nascetur ridiculus mus. Sed congue magna vitae dolor feugiat vehicula.'",
+          "rect": [147, 128, 636, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'magnis dis parturient montes, nascetur ridiculus mus. Sed congue magna vitae dolor feugiat vehicula.'",
+          "rect": [147, 128, 636, 99],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'nulla. Nunc quis porta elit. Pellentesque erat lectus, ultricies a lobortis id, faucibus id quam.'",
+          "rect": [147, 128, 636, 99],
+          "reason": "appeared"
+        },
+        {
+          "object": "InlineTextBox 'nulla. Nunc quis porta elit. Pellentesque erat lectus, ultricies a lobortis id, faucibus id quam.'",
+          "rect": [147, 128, 636, 99],
+          "reason": "disappeared"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='content'",
+          "rect": [400, 128, 392, 180],
+          "reason": "style change"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='left'",
+          "rect": [8, 228, 392, 80],
+          "reason": "incremental"
+        },
+        {
+          "object": "InlineTextBox 'Aenean laoreet dolor id urna eleifend aliquet. Nulla vel dolor'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'Sed volutpat, tellus vel varius vestibulum, purus quam mollis'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'elit. Pellentesque erat lectus, ultricies a lobortis id, faucibus id'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'ipsum. Aliquam ut turpis nisl, in vulputate sapien. Cum sociis'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'natoque penatibus et magnis dis parturient montes, nascetur'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'quam.'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'ridiculus mus. Sed congue magna vitae dolor feugiat vehicula.'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'sapien, in condimentum leo neque sed nulla. Nunc quis porta'",
+          "rect": [400, 128, 391, 179],
+          "reason": "disappeared"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='left'",
+          "rect": [148, 128, 252, 180],
+          "reason": "incremental"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='left'",
+          "rect": [8, 128, 140, 100],
+          "reason": "geometry"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow DIV id='left'",
+      "reason": "incremental"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='content'",
+      "reason": "style change"
+    },
+    {
+      "object": "LayoutBlockFlow P",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutText #text",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean laoreet dolor id urna eleifend aliquet.'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'Nulla vel dolor ipsum. Aliquam ut turpis nisl, in vulputate sapien. Cum sociis natoque penatibus et'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'magnis dis parturient montes, nascetur ridiculus mus. Sed congue magna vitae dolor feugiat vehicula.'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'Sed volutpat, tellus vel varius vestibulum, purus quam mollis sapien, in condimentum leo neque sed'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'nulla. Nunc quis porta elit. Pellentesque erat lectus, ultricies a lobortis id, faucibus id quam.'",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='left'",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='content'",
+      "reason": "style change"
+    },
+    {
+      "object": "LayoutBlockFlow P",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutText #text",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean laoreet dolor id urna eleifend aliquet.'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'Nulla vel dolor ipsum. Aliquam ut turpis nisl, in vulputate sapien. Cum sociis natoque penatibus et'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'magnis dis parturient montes, nascetur ridiculus mus. Sed congue magna vitae dolor feugiat vehicula.'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'Sed volutpat, tellus vel varius vestibulum, purus quam mollis sapien, in condimentum leo neque sed'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'nulla. Nunc quis porta elit. Pellentesque erat lectus, ultricies a lobortis id, faucibus id quam.'",
+      "reason": "geometry"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/iframe-display-block-to-display-none-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/iframe-display-block-to-display-none-expected.txt
new file mode 100644
index 0000000..ad626dd2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/iframe-display-block-to-display-none-expected.txt

@@ -0,0 +1,18 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutIFrame IFRAME id='iframe'",
+          "rect": [8, 72, 732, 94],
+          "reason": "disappeared"
+        }
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/invalidate-cell-in-row-with-offset-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/invalidate-cell-in-row-with-offset-expected.txt
new file mode 100644
index 0000000..be5bce90
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/invalidate-cell-in-row-with-offset-expected.txt

@@ -0,0 +1,36 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableRow TR",
+      "position": [8, 28],
+      "bounds": [234, 102],
+      "backgroundColor": "#0000FF"
+    },
+    {
+      "name": "LayoutTableRow TR class='shadow-inset'",
+      "position": [8, 140],
+      "bounds": [234, 102],
+      "backgroundColor": "#0000FF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableCell TD id='target'",
+          "rect": [10, 0, 102, 102],
+          "reason": "style change"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableCell TD id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/multiple-backgrounds-style-change-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/multiple-backgrounds-style-change-expected.txt
new file mode 100644
index 0000000..daa2563
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/multiple-backgrounds-style-change-expected.txt

@@ -0,0 +1,37 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutBlockFlow DIV id='test' class='composited box changed'",
+      "bounds": [202, 202],
+      "transform": 2
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [8, 8, 0, 1]
+      ]
+    },
+    {
+      "id": 2,
+      "parent": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [50, 50, 0, 1]
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/overhanging-float-detach-repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/overhanging-float-detach-repaint-expected.txt
new file mode 100644
index 0000000..02e7f29
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/overhanging-float-detach-repaint-expected.txt

@@ -0,0 +1,18 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow HTML",
+          "rect": [8, 68, 100, 100],
+          "reason": "disappeared"
+        }
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/positioned-great-grandparent-change-location-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/positioned-great-grandparent-change-location-expected.txt
index 0821600c..6b498454 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/positioned-great-grandparent-change-location-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/positioned-great-grandparent-change-location-expected.txt

@@ -4,7 +4,7 @@
       "name": "LayoutView #document",
       "bounds": [800, 600],
       "contentsOpaque": true,
-      "drawsContent": true,
+      "backgroundColor": "#FFFFFF",
       "paintInvalidations": [
         {
           "object": "LayoutBlockFlow (positioned) DIV",
@@ -18,12 +18,12 @@
         },
         {
           "object": "InlineTextBox 'Target'",
-          "rect": [100, 200, 40, 19],
+          "rect": [100, 200, 41, 19],
           "reason": "geometry"
         },
         {
           "object": "InlineTextBox 'Target'",
-          "rect": [100, 100, 40, 19],
+          "rect": [100, 100, 41, 19],
           "reason": "geometry"
         }
       ]

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/relative-inline-positioned-movement-repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/relative-inline-positioned-movement-repaint-expected.txt
new file mode 100644
index 0000000..6b6aa1b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/relative-inline-positioned-movement-repaint-expected.txt

@@ -0,0 +1,50 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutInline (relative positioned) DIV id='block'",
+      "position": [68, 7],
+      "bounds": [365, 21],
+      "backfaceVisibility": "hidden",
+      "paintInvalidations": [
+        {
+          "object": "LayoutInline (relative positioned) DIV id='block'",
+          "rect": [0, 0, 365, 21],
+          "reason": "full layer"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow BODY",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutInline (relative positioned) DIV id='block'",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineFlowBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutText #text",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox 'When this layer moves it shouldn't generate a repaint rect.'",
+      "reason": "geometry"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/resize-skewed-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/resize-skewed-expected.txt
new file mode 100644
index 0000000..67a71d88
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/resize-skewed-expected.txt

@@ -0,0 +1,24 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow (positioned) DIV id='skewed'",
+          "rect": [100, 50, 600, 500],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow (positioned) DIV id='skewed'",
+      "reason": "incremental"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-after-remove-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-after-remove-expected.txt
index 37e7d3f3..46e0a31 100644
--- a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-after-remove-expected.txt
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-after-remove-expected.txt

@@ -4,7 +4,7 @@
       "name": "LayoutView #document",
       "bounds": [800, 600],
       "contentsOpaque": true,
-      "drawsContent": true,
+      "backgroundColor": "#FFFFFF",
       "paintInvalidations": [
         {
           "object": "InlineTextBox ' '",
@@ -81,6 +81,14 @@
   ],
   "objectPaintInvalidations": [
     {
+      "object": "LayoutBlockFlow HTML",
+      "reason": "selection"
+    },
+    {
+      "object": "LayoutBlockFlow BODY",
+      "reason": "selection"
+    },
+    {
       "object": "LayoutBlockFlow DIV id='test'",
       "reason": "geometry"
     },

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-clear-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-clear-expected.txt
new file mode 100644
index 0000000..14ead962
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/selection-clear-expected.txt

@@ -0,0 +1,83 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow DIV id='firstLine'",
+          "rect": [8, 8, 100, 200],
+          "reason": "full"
+        },
+        {
+          "object": "InlineTextBox 'FAIL: Test did'",
+          "rect": [8, 48, 97, 119],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox 'not run'",
+          "rect": [8, 48, 97, 119],
+          "reason": "disappeared"
+        },
+        {
+          "object": "InlineTextBox '\u00A0'",
+          "rect": [8, 48, 8, 19],
+          "reason": "appeared"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow HTML",
+      "reason": "selection"
+    },
+    {
+      "object": "LayoutBlockFlow BODY",
+      "reason": "selection"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='root'",
+      "reason": "incremental"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='root'",
+      "reason": "selection"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='firstLine'",
+      "reason": "full"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "full"
+    },
+    {
+      "object": "LayoutText #text",
+      "reason": "appeared"
+    },
+    {
+      "object": "InlineTextBox '\u00A0'",
+      "reason": "appeared"
+    },
+    {
+      "object": "LayoutBlockFlow (anonymous)",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutBR BR",
+      "reason": "geometry"
+    },
+    {
+      "object": "InlineTextBox '\n'",
+      "reason": "geometry"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/animated-svg-as-image-transformed-offscreen-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/animated-svg-as-image-transformed-offscreen-expected.txt
new file mode 100644
index 0000000..7699a0da
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/animated-svg-as-image-transformed-offscreen-expected.txt

@@ -0,0 +1,37 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [2008, 2016],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutBlockFlow DIV id='targetDiv'",
+      "bounds": [480, 480],
+      "transform": 2
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [8, 8, 0, 1]
+      ]
+    },
+    {
+      "id": 2,
+      "parent": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [0, -1000, 0, 1]
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/embedded-svg-size-changes-no-layout-triggers-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/embedded-svg-size-changes-no-layout-triggers-expected.txt
new file mode 100644
index 0000000..3b54e63
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/embedded-svg-size-changes-no-layout-triggers-expected.txt

@@ -0,0 +1,52 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow HTML",
+          "rect": [0, 0, 402, 202],
+          "reason": "appeared"
+        },
+        {
+          "object": "LayoutSVGRect rect",
+          "rect": [211, 11, 180, 180],
+          "reason": "paint property change"
+        },
+        {
+          "object": "LayoutSVGRect rect",
+          "rect": [210, 10, 180, 180],
+          "reason": "paint property change"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [11, 11, 180, 180],
+          "reason": "paint property change"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [10, 10, 180, 180],
+          "reason": "paint property change"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow BODY",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutEmbeddedObject OBJECT",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt
new file mode 100644
index 0000000..71e6c2f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt

@@ -0,0 +1,42 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutSVGRoot svg",
+      "bounds": [500, 400],
+      "transform": 1
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [50, 0, 0, 1]
+      ],
+      "flattenInheritedTransform": false
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow DIV id='target'",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutSVGRoot svg",
+      "reason": "geometry"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt
new file mode 100644
index 0000000..f6e3176
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt

@@ -0,0 +1,37 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [58, 58, 100, 100],
+          "reason": "paint property change"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [33, 33, 50, 50],
+          "reason": "paint property change"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow DIV id='target'",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutSVGRoot svg",
+      "reason": "geometry"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/transform-focus-ring-repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/transform-focus-ring-repaint-expected.txt
new file mode 100644
index 0000000..2195541
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/transform-focus-ring-repaint-expected.txt

@@ -0,0 +1,59 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutBlockFlow (positioned) DIV id='target'",
+      "position": [7, 57],
+      "bounds": [402, 542],
+      "backfaceVisibility": "hidden",
+      "backgroundColor": "#FFFF00",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow (positioned) DIV id='target'",
+          "rect": [0, 0, 402, 542],
+          "reason": "full layer"
+        }
+      ]
+    },
+    {
+      "name": "LayoutBlockFlow (positioned) DIV",
+      "bounds": [440, 300],
+      "backgroundColor": "#0000FF",
+      "transform": 2
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [108, 158, 0, 1]
+      ]
+    },
+    {
+      "id": 2,
+      "parent": 1,
+      "transform": [
+        [0, 1, 0, 0],
+        [-1, 0, 0, 0],
+        [0, 0, 1, 0],
+        [0, 0, 0, 1]
+      ],
+      "origin": [150, 150]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow (positioned) DIV id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/transform-foreign-object-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/transform-foreign-object-expected.txt
new file mode 100644
index 0000000..9f4690d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/svg/transform-foreign-object-expected.txt

@@ -0,0 +1,23 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutSVGForeignObject foreignObject",
+          "rect": [108, 8, 100, 100],
+          "reason": "appeared"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [8, 8, 100, 100],
+          "reason": "disappeared"
+        }
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-composited-row-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-composited-row-expected.txt
new file mode 100644
index 0000000..acc81ba
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-composited-row-expected.txt

@@ -0,0 +1,35 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableRow TR id='target'",
+      "position": [8, 96],
+      "bounds": [186, 64],
+      "backgroundColor": "#ADD8E6",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableRow TR id='target'",
+          "rect": [0, 0, 186, 64],
+          "reason": "style change"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableRow TR id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-composited-row-initial-empty-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-composited-row-initial-empty-expected.txt
new file mode 100644
index 0000000..caecc90
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-composited-row-initial-empty-expected.txt

@@ -0,0 +1,35 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableRow TR id='target'",
+      "position": [8, 96],
+      "bounds": [186, 64],
+      "backgroundColor": "#ADD8E6",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableRow TR id='target'",
+          "rect": [0, 0, 186, 64],
+          "reason": "full layer"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableRow TR id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-expected.txt
new file mode 100644
index 0000000..8bfa3c6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-expected.txt

@@ -0,0 +1,29 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableRow TR id='target'",
+          "rect": [8, 96, 186, 64],
+          "reason": "style change"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableRow TR id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-initial-empty-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-initial-empty-expected.txt
new file mode 100644
index 0000000..2fae1bd
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-initial-empty-expected.txt

@@ -0,0 +1,29 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableRow TR id='target'",
+          "rect": [8, 96, 186, 64],
+          "reason": "appeared"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableRow TR id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-composited-row-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-composited-row-expected.txt
new file mode 100644
index 0000000..58f0a57
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-composited-row-expected.txt

@@ -0,0 +1,40 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableSection TBODY id='target'",
+      "position": [8, 28],
+      "bounds": [186, 134],
+      "backgroundColor": "#ADD8E6",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableSection TBODY id='target'",
+          "rect": [0, 0, 186, 134],
+          "reason": "style change"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableRow TR",
+      "position": [34, 118],
+      "bounds": [132, 19]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableSection TBODY id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-expected.txt
new file mode 100644
index 0000000..9778f6a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-expected.txt

@@ -0,0 +1,35 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableSection TBODY id='target'",
+      "position": [8, 28],
+      "bounds": [186, 134],
+      "backgroundColor": "#ADD8E6",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableSection TBODY id='target'",
+          "rect": [0, 0, 186, 134],
+          "reason": "style change"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableSection TBODY id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-initial-empty-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-initial-empty-expected.txt
new file mode 100644
index 0000000..d8755fe
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/table/composited-table-background-section-initial-empty-expected.txt

@@ -0,0 +1,35 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutTableSection TBODY id='target'",
+      "position": [8, 28],
+      "bounds": [186, 134],
+      "backgroundColor": "#ADD8E6",
+      "paintInvalidations": [
+        {
+          "object": "LayoutTableSection TBODY id='target'",
+          "rect": [0, 0, 186, 134],
+          "reason": "full layer"
+        }
+      ]
+    },
+    {
+      "name": "LayoutTableCell TD",
+      "position": [96, 118],
+      "bounds": [10, 19]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutTableSection TBODY id='target'",
+      "reason": "style change"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/transform-repaint-descendants-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/transform-repaint-descendants-expected.txt
new file mode 100644
index 0000000..7254d59
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/transform-repaint-descendants-expected.txt

@@ -0,0 +1,23 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow (relative positioned) DIV id='box'",
+          "rect": [76, 120, 518, 373],
+          "reason": "paint property change"
+        },
+        {
+          "object": "LayoutBlockFlow (relative positioned) DIV id='box'",
+          "rect": [79, 123, 517, 354],
+          "reason": "paint property change"
+        }
+      ]
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/video-mute-repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/video-mute-repaint-expected.txt
new file mode 100644
index 0000000..64417ff
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/video-mute-repaint-expected.txt

@@ -0,0 +1,73 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutFlexibleBox (relative positioned) DIV",
+      "position": [8, 501],
+      "bounds": [700, 32],
+      "backgroundColor": "#FAFAFA",
+      "paintInvalidations": [
+        {
+          "object": "LayoutSlider INPUT",
+          "rect": [580, 15, 70, 2],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='thumb'",
+          "rect": [632, 0, 36, 32],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='thumb'",
+          "rect": [562, 0, 36, 32],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutButton INPUT",
+          "rect": [530, 0, 32, 32],
+          "reason": "full"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow BODY",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutVideo VIDEO id='v'",
+      "reason": "style change"
+    },
+    {
+      "object": "LayoutFlexibleBox (relative positioned) DIV",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutButton INPUT",
+      "reason": "full"
+    },
+    {
+      "object": "LayoutSlider INPUT",
+      "reason": "full"
+    },
+    {
+      "object": "LayoutFlexibleBox DIV",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='thumb'",
+      "reason": "full"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/video-unmute-repaint-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/video-unmute-repaint-expected.txt
new file mode 100644
index 0000000..93458f30
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/video-unmute-repaint-expected.txt

@@ -0,0 +1,73 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutFlexibleBox (relative positioned) DIV",
+      "position": [8, 501],
+      "bounds": [700, 32],
+      "backgroundColor": "#FAFAFA",
+      "paintInvalidations": [
+        {
+          "object": "LayoutSlider INPUT",
+          "rect": [580, 15, 70, 2],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='thumb'",
+          "rect": [597, 0, 36, 32],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutBlockFlow DIV id='thumb'",
+          "rect": [562, 0, 36, 32],
+          "reason": "full"
+        },
+        {
+          "object": "LayoutButton INPUT",
+          "rect": [530, 0, 32, 32],
+          "reason": "full"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow (anonymous)",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutVideo VIDEO id='v'",
+      "reason": "style change"
+    },
+    {
+      "object": "LayoutFlexibleBox (relative positioned) DIV",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutButton INPUT",
+      "reason": "full"
+    },
+    {
+      "object": "LayoutSlider INPUT",
+      "reason": "full"
+    },
+    {
+      "object": "LayoutFlexibleBox DIV",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutBlockFlow DIV id='thumb'",
+      "reason": "full"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/window-resize-background-image-fixed-centered-composited-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/window-resize-background-image-fixed-centered-composited-expected.txt
new file mode 100644
index 0000000..cc37dc5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/window-resize-background-image-fixed-centered-composited-expected.txt

@@ -0,0 +1,93 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [600, 250],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutView #document",
+          "rect": [0, 250, 600, 250],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    }
+  ]
+}
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [400, 250],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutView #document",
+          "rect": [400, 0, 200, 250],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    }
+  ]
+}
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [400, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutView #document",
+          "rect": [0, 250, 400, 350],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    }
+  ]
+}
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutView #document",
+          "rect": [400, 0, 400, 600],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/window-resize-frameset-expected.txt b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/window-resize-frameset-expected.txt
new file mode 100644
index 0000000..5046b6f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/flag-specific/enable-slimming-paint-v2/paint/invalidation/window-resize-frameset-expected.txt

@@ -0,0 +1,177 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [600, 250],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutFrameSet FRAMESET",
+          "rect": [0, 0, 600, 500],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutView #document",
+          "rect": [0, 250, 600, 250],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    },
+    {
+      "object": "LayoutFrameSet FRAMESET",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    }
+  ]
+}
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [400, 250],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutFrameSet FRAMESET",
+          "rect": [0, 0, 600, 250],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutView #document",
+          "rect": [400, 0, 200, 250],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    },
+    {
+      "object": "LayoutFrameSet FRAMESET",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    }
+  ]
+}
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [400, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutFrameSet FRAMESET",
+          "rect": [0, 0, 400, 600],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutView #document",
+          "rect": [0, 250, 400, 350],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    },
+    {
+      "object": "LayoutFrameSet FRAMESET",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    }
+  ]
+}
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutFrameSet FRAMESET",
+          "rect": [0, 0, 800, 600],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutView #document",
+          "rect": [400, 0, 400, 600],
+          "reason": "incremental"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutView #document",
+      "reason": "incremental"
+    },
+    {
+      "object": "LayoutFrameSet FRAMESET",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutFrame FRAME",
+      "reason": "geometry"
+    }
+  ]
+}
+

diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-lifecycleEvents.js b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-lifecycleEvents.js
index b2e9459..6942b0b4 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-lifecycleEvents.js
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-protocol/page/page-lifecycleEvents.js

@@ -14,5 +14,8 @@
     }
   });
 
-  dp.Page.navigate({url: 'data:,Hello!'});
+  // It's possible for Blink to finish the load and run out of tasks before
+  // network idle lifecycle events are generated.  Add a timeout
+  // greater than the network quiet window to guarantee that those events fire.
+  dp.Page.navigate({url: "data:text/html,Hello! <script>setTimeout(() => {}, 2000);</script>"});
 })

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/resources/text-based-repaint.js b/third_party/WebKit/LayoutTests/paint/invalidation/resources/text-based-repaint.js
index 178d4bbf..046c0cb 100644
--- a/third_party/WebKit/LayoutTests/paint/invalidation/resources/text-based-repaint.js
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/resources/text-based-repaint.js

@@ -61,11 +61,13 @@
     }
 
     window.expectedObjectInvalidations.forEach(function(objectName) {
-        assert_true(objectNameSet.has(objectName), "Expected object to be invalidated, but it was not: '" + objectName + "'");
+        assert_true(objectNameSet.has(objectName),
+                    "Expected object to be invalidated, but it was not: '" + objectName + "'\n" + layersWithInvalidationsText);
     });
 
     window.expectedObjectNonInvalidations.forEach(function(objectName) {
-        assert_false(objectNameSet.has(objectName), "Expected object to *not* be invalidated, but it was: '" + objectName + "'");
+        assert_false(objectNameSet.has(objectName),
+                     "Expected object to *not* be invalidated, but it was: '" + objectName + "'\n" + layersWithInvalidationsText);
     });
 }
 

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.html b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.html
new file mode 100644
index 0000000..b220a51
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.html

@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="width: 500px; height: 400px; margin-left: 50px; background: green"></div>

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt
index 8b13789..89d6c4a 100644
--- a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2-expected.txt

@@ -1 +1,63 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow DIV id='target'",
+          "rect": [8, 8, 600, 400],
+          "reason": "geometry"
+        }
+      ]
+    },
+    {
+      "name": "LayoutSVGRoot svg",
+      "position": [8, 8],
+      "bounds": [600, 400],
+      "paintInvalidations": [
+        {
+          "object": "LayoutSVGRect rect",
+          "rect": [50, 0, 500, 400],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [50, 0, 500, 400],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRect rect",
+          "rect": [0, 120, 200, 160],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [0, 120, 200, 160],
+          "reason": "geometry"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow DIV id='target'",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutSVGRoot svg",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutSVGRect rect",
+      "reason": "geometry"
+    }
+  ]
+}
 

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2.html b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2.html
index e3bf5c0..5f422ee 100644
--- a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2.html
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-2.html

@@ -1,18 +1,12 @@
 <!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
 <script src="../resources/text-based-repaint.js"></script>
 <script>
 // When resizing the div that contains SVG, the SVG root element and rect resize
 // accordingly.
-// It's necessary to invalidate the rect in this case.
-window.expectedObjectInvalidations.push("LayoutSVGRect rect");
-window.outputRepaintRects = false;
-
 function repaintTest() {
   target.style.width = "600px";
 };
-onload = runRepaintTest;
+onload = runRepaintAndPixelTest;
 </script>
 <div id="target" style="width: 200px; height: 400px">
   <svg width='500' height='400' viewBox='0 0 500 400'

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.html b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.html
new file mode 100644
index 0000000..c358cb9d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.html

@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="margin-left: 50px; margin-top: 58px; width: 100px; height: 100px; background: black"></div>

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt
index 8b13789..2dd311b 100644
--- a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children-expected.txt

@@ -1 +1,56 @@
+{
+  "layers": [
+    {
+      "name": "LayoutView #document",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutBlockFlow DIV id='target'",
+          "rect": [8, 8, 200, 200],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRect rect",
+          "rect": [58, 58, 100, 100],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [58, 58, 100, 100],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRect rect",
+          "rect": [33, 33, 50, 50],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutSVGRoot svg",
+          "rect": [33, 33, 50, 50],
+          "reason": "geometry"
+        }
+      ]
+    }
+  ],
+  "objectPaintInvalidations": [
+    {
+      "object": "LayoutBlockFlow DIV id='target'",
+      "reason": "geometry"
+    },
+    {
+      "object": "RootInlineBox",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutSVGRoot svg",
+      "reason": "geometry"
+    },
+    {
+      "object": "LayoutSVGRect rect",
+      "reason": "geometry"
+    }
+  ]
+}
 

diff --git a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children.html b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children.html
index c35a512..102446cd 100644
--- a/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children.html
+++ b/third_party/WebKit/LayoutTests/paint/invalidation/svg/resize-svg-invalidate-children.html

@@ -1,14 +1,8 @@
 <!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
 <script src="../resources/text-based-repaint.js"></script>
 <script>
 // When resizing the div that contains SVG, the SVG root element and rect resize accordingly.
-// It's necessary to invalidate the rect in this case.
-window.expectedObjectInvalidations.push("LayoutSVGRect rect");
-
-onload = runRepaintTest;
-window.outputRepaintRects = false;
+onload = runRepaintAndPixelTest;
 function repaintTest() {
 	target.style.width = '200px';
 	target.style.height= '200px';

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-blobs/external/wpt/fetch/api/headers/headers-record-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-blobs/external/wpt/fetch/api/headers/headers-record-expected.txt
new file mode 100644
index 0000000..3d8190e1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-blobs/external/wpt/fetch/api/headers/headers-record-expected.txt

@@ -0,0 +1,16 @@
+This is a testharness.js-based test.
+PASS Passing nothing to Headers constructor
+PASS Passing undefined to Headers constructor
+PASS Passing null to Headers constructor
+PASS Basic operation with one property
+PASS Basic operation with one property and a proto
+PASS Correct operation ordering with two properties
+PASS Correct operation ordering with two properties one of which has an invalid name
+PASS Correct operation ordering with two properties one of which has an invalid value
+PASS Correct operation ordering with non-enumerable properties
+PASS Correct operation ordering with undefined descriptors
+FAIL Correct operation ordering with repeated keys assert_throws: function "function () { var h = new Headers(proxy); }" did not throw
+PASS Basic operation with Symbol keys
+PASS Operation with non-enumerable Symbol keys
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-blobs/external/wpt/fetch/api/response/response-consume-stream-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-blobs/external/wpt/fetch/api/response/response-consume-stream-expected.txt
deleted file mode 100644
index 1c034b4..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-blobs/external/wpt/fetch/api/response/response-consume-stream-expected.txt
+++ /dev/null

@@ -1,12 +0,0 @@
-This is a testharness.js-based test.
-PASS Read empty text response's body as readableStream
-PASS Read empty blob response's body as readableStream
-PASS Read blob response's body as readableStream
-PASS Read text response's body as readableStream
-PASS Read URLSearchParams response's body as readableStream
-PASS Read array buffer response's body as readableStream
-FAIL Read form data response's body as readableStream assert_array_equals: Retrieve and verify stream lengths differ, expected 10 got 140
-PASS Getting an error Response stream
-FAIL Getting a redirect Response stream assert_not_equals: got disallowed value undefined
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-localstorage/external/wpt/webstorage/storage_session_window_noopener-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-localstorage/external/wpt/webstorage/storage_session_window_noopener-expected.txt
new file mode 100644
index 0000000..f7a4f86
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/mojo-localstorage/external/wpt/webstorage/storage_session_window_noopener-expected.txt

@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL A new noopener window to make sure there is a not copy of the previous window's sessionStorage assert_equals: storage.getItem('FOO') expected (object) null but got (string) "BAR"
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/outofblink-cors/external/wpt/fetch/api/headers/headers-record-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/outofblink-cors/external/wpt/fetch/api/headers/headers-record-expected.txt
new file mode 100644
index 0000000..3d8190e1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/outofblink-cors/external/wpt/fetch/api/headers/headers-record-expected.txt

@@ -0,0 +1,16 @@
+This is a testharness.js-based test.
+PASS Passing nothing to Headers constructor
+PASS Passing undefined to Headers constructor
+PASS Passing null to Headers constructor
+PASS Basic operation with one property
+PASS Basic operation with one property and a proto
+PASS Correct operation ordering with two properties
+PASS Correct operation ordering with two properties one of which has an invalid name
+PASS Correct operation ordering with two properties one of which has an invalid value
+PASS Correct operation ordering with non-enumerable properties
+PASS Correct operation ordering with undefined descriptors
+FAIL Correct operation ordering with repeated keys assert_throws: function "function () { var h = new Headers(proxy); }" did not throw
+PASS Basic operation with Symbol keys
+PASS Operation with non-enumerable Symbol keys
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/outofblink-cors/external/wpt/fetch/api/response/response-consume-stream-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/outofblink-cors/external/wpt/fetch/api/response/response-consume-stream-expected.txt
deleted file mode 100644
index 1c034b4..0000000
--- a/third_party/WebKit/LayoutTests/platform/linux/virtual/outofblink-cors/external/wpt/fetch/api/response/response-consume-stream-expected.txt
+++ /dev/null

@@ -1,12 +0,0 @@
-This is a testharness.js-based test.
-PASS Read empty text response's body as readableStream
-PASS Read empty blob response's body as readableStream
-PASS Read blob response's body as readableStream
-PASS Read text response's body as readableStream
-PASS Read URLSearchParams response's body as readableStream
-PASS Read array buffer response's body as readableStream
-FAIL Read form data response's body as readableStream assert_array_equals: Retrieve and verify stream lengths differ, expected 10 got 140
-PASS Getting an error Response stream
-FAIL Getting a redirect Response stream assert_not_equals: got disallowed value undefined
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-blobs/external/wpt/fetch/api/headers/headers-record-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-blobs/external/wpt/fetch/api/headers/headers-record-expected.txt
new file mode 100644
index 0000000..3d8190e1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-blobs/external/wpt/fetch/api/headers/headers-record-expected.txt

@@ -0,0 +1,16 @@
+This is a testharness.js-based test.
+PASS Passing nothing to Headers constructor
+PASS Passing undefined to Headers constructor
+PASS Passing null to Headers constructor
+PASS Basic operation with one property
+PASS Basic operation with one property and a proto
+PASS Correct operation ordering with two properties
+PASS Correct operation ordering with two properties one of which has an invalid name
+PASS Correct operation ordering with two properties one of which has an invalid value
+PASS Correct operation ordering with non-enumerable properties
+PASS Correct operation ordering with undefined descriptors
+FAIL Correct operation ordering with repeated keys assert_throws: function "function () { var h = new Headers(proxy); }" did not throw
+PASS Basic operation with Symbol keys
+PASS Operation with non-enumerable Symbol keys
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-blobs/external/wpt/fetch/api/response/response-consume-stream-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-blobs/external/wpt/fetch/api/response/response-consume-stream-expected.txt
deleted file mode 100644
index 1c034b4..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-blobs/external/wpt/fetch/api/response/response-consume-stream-expected.txt
+++ /dev/null

@@ -1,12 +0,0 @@
-This is a testharness.js-based test.
-PASS Read empty text response's body as readableStream
-PASS Read empty blob response's body as readableStream
-PASS Read blob response's body as readableStream
-PASS Read text response's body as readableStream
-PASS Read URLSearchParams response's body as readableStream
-PASS Read array buffer response's body as readableStream
-FAIL Read form data response's body as readableStream assert_array_equals: Retrieve and verify stream lengths differ, expected 10 got 140
-PASS Getting an error Response stream
-FAIL Getting a redirect Response stream assert_not_equals: got disallowed value undefined
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-localstorage/external/wpt/webstorage/storage_session_window_noopener-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-localstorage/external/wpt/webstorage/storage_session_window_noopener-expected.txt
new file mode 100644
index 0000000..f7a4f86
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/mojo-localstorage/external/wpt/webstorage/storage_session_window_noopener-expected.txt

@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL A new noopener window to make sure there is a not copy of the previous window's sessionStorage assert_equals: storage.getItem('FOO') expected (object) null but got (string) "BAR"
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/outofblink-cors/external/wpt/fetch/api/headers/headers-record-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/outofblink-cors/external/wpt/fetch/api/headers/headers-record-expected.txt
new file mode 100644
index 0000000..3d8190e1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/outofblink-cors/external/wpt/fetch/api/headers/headers-record-expected.txt

@@ -0,0 +1,16 @@
+This is a testharness.js-based test.
+PASS Passing nothing to Headers constructor
+PASS Passing undefined to Headers constructor
+PASS Passing null to Headers constructor
+PASS Basic operation with one property
+PASS Basic operation with one property and a proto
+PASS Correct operation ordering with two properties
+PASS Correct operation ordering with two properties one of which has an invalid name
+PASS Correct operation ordering with two properties one of which has an invalid value
+PASS Correct operation ordering with non-enumerable properties
+PASS Correct operation ordering with undefined descriptors
+FAIL Correct operation ordering with repeated keys assert_throws: function "function () { var h = new Headers(proxy); }" did not throw
+PASS Basic operation with Symbol keys
+PASS Operation with non-enumerable Symbol keys
+Harness: the test ran to completion.
+

diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/outofblink-cors/external/wpt/fetch/api/response/response-consume-stream-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/outofblink-cors/external/wpt/fetch/api/response/response-consume-stream-expected.txt
deleted file mode 100644
index 1c034b4..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/outofblink-cors/external/wpt/fetch/api/response/response-consume-stream-expected.txt
+++ /dev/null

@@ -1,12 +0,0 @@
-This is a testharness.js-based test.
-PASS Read empty text response's body as readableStream
-PASS Read empty blob response's body as readableStream
-PASS Read blob response's body as readableStream
-PASS Read text response's body as readableStream
-PASS Read URLSearchParams response's body as readableStream
-PASS Read array buffer response's body as readableStream
-FAIL Read form data response's body as readableStream assert_array_equals: Retrieve and verify stream lengths differ, expected 10 got 140
-PASS Getting an error Response stream
-FAIL Getting a redirect Response stream assert_not_equals: got disallowed value undefined
-Harness: the test ran to completion.
-

diff --git a/third_party/WebKit/LayoutTests/tables/table-transform-absolute-position-child-expected.png b/third_party/WebKit/LayoutTests/tables/table-transform-absolute-position-child-expected.png
deleted file mode 100644
index 617772a..0000000
--- a/third_party/WebKit/LayoutTests/tables/table-transform-absolute-position-child-expected.png
+++ /dev/null
Binary files differ

diff --git a/third_party/WebKit/LayoutTests/tables/table-transform-absolute-position-child.html b/third_party/WebKit/LayoutTests/tables/table-transform-absolute-position-child.html
deleted file mode 100644
index 5b74bf348..0000000
--- a/third_party/WebKit/LayoutTests/tables/table-transform-absolute-position-child.html
+++ /dev/null

@@ -1,18 +0,0 @@
-<!DOCTYPE html>
-<style>
-  .abs-overflow {
-    overflow: hidden;
-    position: absolute;
-    width: 100px;
-    height: 200px;
-    background-color: green;
-  }
-  .transformed {
-    display: table-header-group;
-    transform: rotate(45deg);
-  }
-</style>
-<div class="transformed">
-  <div class="abs-overflow">
-  </div>
-</div>

diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 6605a59..a80b0a5d6 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt

@@ -44,11 +44,6 @@
     getter multiline
     getter multiselectable
     getter onaccessibleclick
-    getter onaccessiblecontextmenu
-    getter onaccessibledecrement
-    getter onaccessiblefocus
-    getter onaccessibleincrement
-    getter onaccessiblescrollintoview
     getter orientation
     getter owns
     getter placeholder
@@ -98,11 +93,6 @@
     setter multiline
     setter multiselectable
     setter onaccessibleclick
-    setter onaccessiblecontextmenu
-    setter onaccessibledecrement
-    setter onaccessiblefocus
-    setter onaccessibleincrement
-    setter onaccessiblescrollintoview
     setter orientation
     setter owns
     setter placeholder

diff --git a/third_party/WebKit/Source/core/dom/AccessibleNode.h b/third_party/WebKit/Source/core/dom/AccessibleNode.h
index da4c05ac..5f95f8c 100644
--- a/third_party/WebKit/Source/core/dom/AccessibleNode.h
+++ b/third_party/WebKit/Source/core/dom/AccessibleNode.h

@@ -332,11 +332,6 @@
   ExecutionContext* GetExecutionContext() const override;
 
   DEFINE_ATTRIBUTE_EVENT_LISTENER(accessibleclick);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(accessiblecontextmenu);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(accessibledecrement);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(accessiblefocus);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(accessibleincrement);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(accessiblescrollintoview);
 
   DECLARE_VIRTUAL_TRACE();
 

diff --git a/third_party/WebKit/Source/core/dom/AccessibleNode.idl b/third_party/WebKit/Source/core/dom/AccessibleNode.idl
index a7a5523..1de11290 100644
--- a/third_party/WebKit/Source/core/dom/AccessibleNode.idl
+++ b/third_party/WebKit/Source/core/dom/AccessibleNode.idl

@@ -57,9 +57,4 @@
     attribute DOMString? valueText;
 
     attribute EventHandler onaccessibleclick;
-    attribute EventHandler onaccessiblecontextmenu;
-    attribute EventHandler onaccessibledecrement;
-    attribute EventHandler onaccessiblefocus;
-    attribute EventHandler onaccessibleincrement;
-    attribute EventHandler onaccessiblescrollintoview;
 };

diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index d79843d..0cd93f3d 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp

@@ -628,7 +628,8 @@
   page->GetFocusController().SetFocusedFrame(parent);
   // setFocusedFrame can dispatch synchronous focus/blur events.  The document
   // tree might be modified.
-  if (new_selection.IsNonOrphanedCaretOrRange())
+  if (!new_selection.IsNone() &&
+      new_selection.IsValidFor(*(ToLocalFrame(parent)->GetDocument())))
     ToLocalFrame(parent)->Selection().SetSelection(new_selection.AsSelection());
 }
 

diff --git a/third_party/WebKit/Source/core/editing/SelectionController.cpp b/third_party/WebKit/Source/core/editing/SelectionController.cpp
index 9b14421..78f483b 100644
--- a/third_party/WebKit/Source/core/editing/SelectionController.cpp
+++ b/third_party/WebKit/Source/core/editing/SelectionController.cpp

@@ -294,13 +294,14 @@
   // link or image.
   bool extend_selection = IsExtendingSelection(event);
 
-  const VisiblePositionInFlatTree& visible_hit_pos =
+  const VisiblePositionInFlatTree& visible_hit_position =
       VisiblePositionOfHitTestResult(event.GetHitTestResult());
-  const VisiblePositionInFlatTree& visible_pos =
-      visible_hit_pos.IsNull()
+  const PositionInFlatTreeWithAffinity& position_to_use =
+      visible_hit_position.IsNull()
           ? CreateVisiblePosition(
                 PositionInFlatTree::FirstPositionInOrBeforeNode(inner_node))
-          : visible_hit_pos;
+                .ToPositionWithAffinity()
+          : visible_hit_position.ToPositionWithAffinity();
   const VisibleSelectionInFlatTree& selection =
       this->Selection().ComputeVisibleSelectionInFlatTree();
 
@@ -331,11 +332,12 @@
   if (extend_selection && !selection.IsNone()) {
     // Note: "fast/events/shift-click-user-select-none.html" makes
     // |pos.isNull()| true.
-    const PositionInFlatTree& pos = AdjustPositionRespectUserSelectAll(
-        inner_node, selection.Start(), selection.End(),
-        visible_pos.DeepEquivalent());
+    const PositionInFlatTree& adjusted_position =
+        AdjustPositionRespectUserSelectAll(inner_node, selection.Start(),
+                                           selection.End(),
+                                           position_to_use.GetPosition());
     const TextGranularity granularity = Selection().Granularity();
-    if (pos.IsNull()) {
+    if (adjusted_position.IsNull()) {
       UpdateSelectionForMouseDownDispatchingSelectStart(
           inner_node, selection.AsSelection(), granularity,
           HandleVisibility::kNotVisible);
@@ -344,10 +346,10 @@
     UpdateSelectionForMouseDownDispatchingSelectStart(
         inner_node,
         frame_->GetEditor().Behavior().ShouldConsiderSelectionAsDirectional()
-            ? ExtendSelectionAsDirectional(pos, selection.AsSelection(),
-                                           granularity)
-            : ExtendSelectionAsNonDirectional(pos, selection.AsSelection(),
-                                              granularity),
+            ? ExtendSelectionAsDirectional(adjusted_position,
+                                           selection.AsSelection(), granularity)
+            : ExtendSelectionAsNonDirectional(
+                  adjusted_position, selection.AsSelection(), granularity),
         granularity, HandleVisibility::kNotVisible);
     return false;
   }
@@ -359,7 +361,7 @@
     return false;
   }
 
-  if (visible_pos.IsNull()) {
+  if (position_to_use.IsNull()) {
     UpdateSelectionForMouseDownDispatchingSelectStart(
         inner_node, SelectionInFlatTree(), TextGranularity::kCharacter,
         HandleVisibility::kNotVisible);
@@ -380,16 +382,15 @@
   UpdateSelectionForMouseDownDispatchingSelectStart(
       inner_node,
       ExpandSelectionToRespectUserSelectAll(
-          inner_node, SelectionInFlatTree::Builder()
-                          .Collapse(visible_pos.ToPositionWithAffinity())
-                          .Build()),
+          inner_node,
+          SelectionInFlatTree::Builder().Collapse(position_to_use).Build()),
       TextGranularity::kCharacter,
       is_handle_visible ? HandleVisibility::kVisible
                         : HandleVisibility::kNotVisible);
 
   if (has_editable_style && event.Event().FromTouch()) {
     frame_->GetTextSuggestionController().HandlePotentialMisspelledWordTap(
-        visible_pos.DeepEquivalent());
+        position_to_use.GetPosition());
   }
 
   return false;

diff --git a/third_party/WebKit/Source/core/events/EventTypeNames.json5 b/third_party/WebKit/Source/core/events/EventTypeNames.json5
index 8f0c487..e50d8947 100644
--- a/third_party/WebKit/Source/core/events/EventTypeNames.json5
+++ b/third_party/WebKit/Source/core/events/EventTypeNames.json5

@@ -18,11 +18,6 @@
     "abort",
     "abortpayment",
     "accessibleclick",
-    "accessiblecontextmenu",
-    "accessibledecrement",
-    "accessiblefocus",
-    "accessibleincrement",
-    "accessiblescrollintoview",
     "activate",
     "active",
     "addsourcebuffer",

diff --git a/third_party/WebKit/Source/core/html/HTMLFrameElement.cpp b/third_party/WebKit/Source/core/html/HTMLFrameElement.cpp
index 3a936e2..e962fbed 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFrameElement.cpp

@@ -77,7 +77,7 @@
 }
 
 Vector<WebParsedFeaturePolicyDeclaration>
-HTMLFrameElement::ConstructContainerPolicy(Vector<String>*) const {
+HTMLFrameElement::ConstructContainerPolicy(Vector<String>*, bool*) const {
   // Frame elements are not allowed to enable the fullscreen feature. Add an
   // empty whitelist for the fullscreen feature so that the framed content is
   // unable to use the API, regardless of origin.

diff --git a/third_party/WebKit/Source/core/html/HTMLFrameElement.h b/third_party/WebKit/Source/core/html/HTMLFrameElement.h
index e75b0fa..1d112bc 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLFrameElement.h

@@ -40,7 +40,8 @@
   bool NoResize() const;
 
   Vector<WebParsedFeaturePolicyDeclaration> ConstructContainerPolicy(
-      Vector<String>*) const override;
+      Vector<String>* /* messages */,
+      bool* /* old_syntax */) const override;
 
  private:
   explicit HTMLFrameElement(Document&);

diff --git a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp
index a2960334..68025b9 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp

@@ -144,7 +144,7 @@
   sandbox_flags_ = flags;
   // Recalculate the container policy in case the allow-same-origin flag has
   // changed.
-  container_policy_ = ConstructContainerPolicy(nullptr);
+  container_policy_ = ConstructContainerPolicy(nullptr, nullptr);
 
   // Don't notify about updates if ContentFrame() is null, for example when
   // the subframe hasn't been created yet.
@@ -165,8 +165,9 @@
     plugin->Dispose();
 }
 
-void HTMLFrameOwnerElement::UpdateContainerPolicy(Vector<String>* messages) {
-  container_policy_ = ConstructContainerPolicy(messages);
+void HTMLFrameOwnerElement::UpdateContainerPolicy(Vector<String>* messages,
+                                                  bool* old_syntax) {
+  container_policy_ = ConstructContainerPolicy(messages, old_syntax);
   // Don't notify about updates if ContentFrame() is null, for example when
   // the subframe hasn't been created yet.
   if (ContentFrame()) {

diff --git a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h
index 09d4788..e2173b3 100644
--- a/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.h

@@ -131,12 +131,19 @@
   // Return a feature policy container policy for this frame, based on the
   // frame attributes and the effective origin specified in the frame
   // attributes.
+  // If |old_syntax| (bool*) is not null, it will be set true if the deprecated
+  // space-deparated feature list syntax is detected.
+  // TODO(loonybear): remove the boolean once the space separated feature list
+  // syntax is deprecated.
+  // https://crbug.com/761009.
   virtual Vector<WebParsedFeaturePolicyDeclaration> ConstructContainerPolicy(
-      Vector<String>*) const = 0;
+      Vector<String>* /*  messages */,
+      bool* /* old_syntax */) const = 0;
 
   // Update the container policy and notify the frame loader client of any
   // changes.
-  void UpdateContainerPolicy(Vector<String>* messages = nullptr);
+  void UpdateContainerPolicy(Vector<String>* messages = nullptr,
+                             bool* old_syntax = nullptr);
 
  private:
   // Intentionally private to prevent redundant checks when the type is

diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
index b9ea7f0..5c53441 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp

@@ -178,15 +178,23 @@
     if (allow_ != value) {
       allow_ = value;
       Vector<String> messages;
-      UpdateContainerPolicy(&messages);
-      UseCounter::Count(GetDocument(),
-                        WebFeature::kFeaturePolicyAllowAttribute);
+      bool old_syntax = false;
+      UpdateContainerPolicy(&messages, &old_syntax);
       if (!messages.IsEmpty()) {
         for (const String& message : messages) {
           GetDocument().AddConsoleMessage(ConsoleMessage::Create(
               kOtherMessageSource, kWarningMessageLevel, message));
         }
       }
+
+      if (old_syntax) {
+        UseCounter::Count(
+            GetDocument(),
+            WebFeature::kFeaturePolicyAllowAttributeDeprecatedSyntax);
+      } else {
+        UseCounter::Count(GetDocument(),
+                          WebFeature::kFeaturePolicyAllowAttribute);
+      }
     }
   } else {
     if (name == srcAttr)
@@ -196,11 +204,13 @@
 }
 
 Vector<WebParsedFeaturePolicyDeclaration>
-HTMLIFrameElement::ConstructContainerPolicy(Vector<String>* messages) const {
+HTMLIFrameElement::ConstructContainerPolicy(Vector<String>* messages,
+                                            bool* old_syntax) const {
   RefPtr<SecurityOrigin> src_origin = GetOriginForFeaturePolicy();
   RefPtr<SecurityOrigin> self_origin = GetDocument().GetSecurityOrigin();
   Vector<WebParsedFeaturePolicyDeclaration> container_policy =
-      ParseFeaturePolicyAttribute(allow_, self_origin, src_origin, messages);
+      ParseFeaturePolicyAttribute(allow_, self_origin, src_origin, messages,
+                                  old_syntax);
 
   // If allowfullscreen attribute is present and no fullscreen policy is set,
   // enable the feature for all origins.

diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElement.h b/third_party/WebKit/Source/core/html/HTMLIFrameElement.h
index 0d81880..548306c 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElement.h

@@ -46,7 +46,8 @@
   DOMTokenList* sandbox() const;
 
   Vector<WebParsedFeaturePolicyDeclaration> ConstructContainerPolicy(
-      Vector<String>* messages = nullptr) const override;
+      Vector<String>* /* messages */,
+      bool* /* old_syntax */) const override;
 
  private:
   explicit HTMLIFrameElement(Document&);

diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElementTest.cpp b/third_party/WebKit/Source/core/html/HTMLIFrameElementTest.cpp
index c353fe2..2541351a 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElementTest.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElementTest.cpp

@@ -212,7 +212,7 @@
   EXPECT_EQ(1UL, container_policy2[1].origins.size());
   EXPECT_EQ("http://example.net", container_policy2[1].origins[0].ToString());
 
-  // TODO(lunalu): Remove this test when deprecating the old syntax.
+  // TODO(loonybear): Remove this test when deprecating the old syntax.
   // Test for supporting old allow syntax.
   frame_element->setAttribute(HTMLNames::allowAttr, "payment fullscreen");
 
@@ -296,7 +296,7 @@
   HTMLIFrameElement* frame_element = HTMLIFrameElement::Create(*document);
 
   WebParsedFeaturePolicy container_policy =
-      frame_element->ConstructContainerPolicy(nullptr);
+      frame_element->ConstructContainerPolicy(nullptr, nullptr);
   EXPECT_EQ(0UL, container_policy.size());
 }
 
@@ -311,7 +311,7 @@
   HTMLIFrameElement* frame_element = HTMLIFrameElement::Create(*document);
   frame_element->setAttribute(HTMLNames::allowAttr, "payment; usb");
   WebParsedFeaturePolicy container_policy =
-      frame_element->ConstructContainerPolicy(nullptr);
+      frame_element->ConstructContainerPolicy(nullptr, nullptr);
   EXPECT_EQ(2UL, container_policy.size());
   EXPECT_EQ(WebFeaturePolicyFeature::kPayment, container_policy[0].feature);
   EXPECT_FALSE(container_policy[0].matches_all_origins);
@@ -339,7 +339,7 @@
   frame_element->SetBooleanAttribute(HTMLNames::allowfullscreenAttr, true);
 
   WebParsedFeaturePolicy container_policy =
-      frame_element->ConstructContainerPolicy(nullptr);
+      frame_element->ConstructContainerPolicy(nullptr, nullptr);
   EXPECT_EQ(1UL, container_policy.size());
   EXPECT_EQ(WebFeaturePolicyFeature::kFullscreen, container_policy[0].feature);
   EXPECT_TRUE(container_policy[0].matches_all_origins);
@@ -358,7 +358,7 @@
   frame_element->SetBooleanAttribute(HTMLNames::allowpaymentrequestAttr, true);
 
   WebParsedFeaturePolicy container_policy =
-      frame_element->ConstructContainerPolicy(nullptr);
+      frame_element->ConstructContainerPolicy(nullptr, nullptr);
   EXPECT_EQ(2UL, container_policy.size());
   EXPECT_EQ(WebFeaturePolicyFeature::kUsb, container_policy[0].feature);
   EXPECT_FALSE(container_policy[0].matches_all_origins);
@@ -388,7 +388,7 @@
   frame_element->SetBooleanAttribute(HTMLNames::allowpaymentrequestAttr, true);
 
   WebParsedFeaturePolicy container_policy =
-      frame_element->ConstructContainerPolicy(nullptr);
+      frame_element->ConstructContainerPolicy(nullptr, nullptr);
   EXPECT_EQ(3UL, container_policy.size());
   EXPECT_EQ(WebFeaturePolicyFeature::kPayment, container_policy[0].feature);
   EXPECT_FALSE(container_policy[0].matches_all_origins);

diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
index 989865f..ed41f42 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.cpp

@@ -269,7 +269,7 @@
 }
 
 Vector<WebParsedFeaturePolicyDeclaration>
-HTMLPlugInElement::ConstructContainerPolicy(Vector<String>*) const {
+HTMLPlugInElement::ConstructContainerPolicy(Vector<String>*, bool*) const {
   // Plugin elements (<object> and <embed>) are not allowed to enable the
   // fullscreen feature. Add an empty whitelist for the fullscreen feature so
   // that the nested browsing context is unable to use the API, regardless of

diff --git a/third_party/WebKit/Source/core/html/HTMLPlugInElement.h b/third_party/WebKit/Source/core/html/HTMLPlugInElement.h
index 4f4e18ba..8be2015 100644
--- a/third_party/WebKit/Source/core/html/HTMLPlugInElement.h
+++ b/third_party/WebKit/Source/core/html/HTMLPlugInElement.h

@@ -84,7 +84,8 @@
   void CreatePluginWithoutLayoutObject();
 
   virtual Vector<WebParsedFeaturePolicyDeclaration> ConstructContainerPolicy(
-      Vector<String>*) const;
+      Vector<String>* /* messages */,
+      bool* /* old_syntax */) const;
 
  protected:
   HTMLPlugInElement(const QualifiedName& tag_name,

diff --git a/third_party/WebKit/Source/core/html/HTMLStyleElement.cpp b/third_party/WebKit/Source/core/html/HTMLStyleElement.cpp
index dbca8be6..66a433c 100644
--- a/third_party/WebKit/Source/core/html/HTMLStyleElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLStyleElement.cpp

@@ -57,6 +57,9 @@
              GetDocument().IsActive() && sheet_) {
     sheet_->SetMediaQueries(MediaQuerySet::Create(params.new_value));
     GetDocument().GetStyleEngine().MediaQueriesChangedInScope(GetTreeScope());
+  } else if (params.name == typeAttr) {
+    HTMLElement::ParseAttribute(params);
+    StyleElement::ChildrenChanged(*this);
   } else {
     HTMLElement::ParseAttribute(params);
   }

diff --git a/third_party/WebKit/Source/core/layout/LayoutReplaced.cpp b/third_party/WebKit/Source/core/layout/LayoutReplaced.cpp
index f974aff..0bce37a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutReplaced.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutReplaced.cpp

@@ -94,8 +94,7 @@
 
   ClearNeedsLayout();
 
-  if (!RuntimeEnabledFeatures::SlimmingPaintV2Enabled() &&
-      ReplacedContentRect() != old_content_rect)
+  if (ReplacedContentRect() != old_content_rect)
     SetShouldDoFullPaintInvalidation();
 }
 

diff --git a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
index 951364c..be213a9 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTableSection.cpp

@@ -113,11 +113,6 @@
   LayoutTableBoxComponent::StyleDidChange(diff, old_style);
   PropagateStyleToAnonymousChildren();
 
-  // We allow transforms on table sections, so they must be able to act as
-  // containers for style reasons.
-  SetCanContainFixedPositionObjects(
-      StyleRef().CanContainFixedPositionObjects());
-
   if (!old_style)
     return;
 
@@ -129,10 +124,9 @@
       *this, *table, diff, *old_style);
 
   if (LayoutTableBoxComponent::DoCellsHaveDirtyWidth(*this, *table, diff,
-                                                     *old_style)) {
+                                                     *old_style))
     MarkAllCellsWidthsDirtyAndOrNeedsLayout(
         LayoutTable::kMarkDirtyAndNeedsLayout);
-  }
 }
 
 void LayoutTableSection::WillBeRemovedFromTree() {

diff --git a/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp b/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp
index 6a7cbd9..2d4391f 100644
--- a/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp
+++ b/third_party/WebKit/Source/core/layout/TableLayoutAlgorithmFixed.cpp

@@ -123,7 +123,7 @@
       }
       // TODO(alancutter): Make this work correctly for calc lengths.
       if ((col_style_logical_width.IsFixed() ||
-           col_style_logical_width.IsPercentOrCalc()) &&
+           col_style_logical_width.IsPercent()) &&
           col_style_logical_width.IsPositive()) {
         width_[current_effective_column] = col_style_logical_width;
         width_[current_effective_column] *= span_in_current_effective_column;
@@ -255,7 +255,7 @@
     if (width_[i].IsFixed()) {
       calc_width[i] = width_[i].Value();
       total_fixed_width += calc_width[i];
-    } else if (width_[i].IsPercentOrCalc()) {
+    } else if (width_[i].IsPercent()) {
       // TODO(alancutter): Make this work correctly for calc lengths.
       calc_width[i] =
           ValueForLength(width_[i], LayoutUnit(table_logical_width)).ToInt();
@@ -303,7 +303,7 @@
         total_percent_width = 0;
         for (unsigned i = 0; i < n_eff_cols; i++) {
           // TODO(alancutter): Make this work correctly for calc lengths.
-          if (width_[i].IsPercentOrCalc()) {
+          if (width_[i].IsPercent()) {
             calc_width[i] = width_[i].Percent() *
                             (table_logical_width - total_fixed_width) /
                             total_percent;
@@ -329,7 +329,6 @@
         if (!remaining_width)
           break;
         last_auto = i;
-        num_auto--;
         DCHECK_GE(auto_span, span);
         auto_span -= span;
       }

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_layout_algorithm.cc b/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_layout_algorithm.cc
index 22fb69e..8295db8 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_layout_algorithm.cc
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_layout_algorithm.cc

@@ -296,8 +296,7 @@
 
   NGBoxFragment fragment(
       ConstraintSpace().WritingMode(),
-      ToNGPhysicalBoxFragment(
-          item_result->layout_result->PhysicalFragment().Get()));
+      ToNGPhysicalBoxFragment(*item_result->layout_result->PhysicalFragment()));
   NGLineHeightMetrics metrics = fragment.BaselineMetrics(
       {line_info.UseFirstLineStyle()
            ? NGBaselineAlgorithmType::kAtomicInlineForFirstLine

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_node.cc b/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_node.cc
index 6a9e5269..016efbf 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_node.cc
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_inline_node.cc

@@ -65,18 +65,17 @@
                     HashMap<LineLayoutItem, FragmentPosition>* positions_out) {
   for (const auto& child : children) {
     if (child->Type() == NGPhysicalFragment::kFragmentText) {
-      const auto* physical_fragment = ToNGPhysicalTextFragment(child.Get());
-      const NGInlineItem& item =
-          items[physical_fragment->ItemIndexDeprecated()];
+      const auto& physical_fragment = ToNGPhysicalTextFragment(*child);
+      const NGInlineItem& item = items[physical_fragment.ItemIndexDeprecated()];
       BidiRun* run;
       if (item.Type() == NGInlineItem::kText ||
           item.Type() == NGInlineItem::kControl) {
         LayoutObject* layout_object = item.GetLayoutObject();
         DCHECK(layout_object->IsText());
         unsigned text_offset =
-            text_offsets[physical_fragment->ItemIndexDeprecated()];
-        run = new BidiRun(physical_fragment->StartOffset() - text_offset,
-                          physical_fragment->EndOffset() - text_offset,
+            text_offsets[physical_fragment.ItemIndexDeprecated()];
+        run = new BidiRun(physical_fragment.StartOffset() - text_offset,
+                          physical_fragment.EndOffset() - text_offset,
                           item.BidiLevel(), LineLayoutItem(layout_object));
         layout_object->ClearNeedsLayout();
       } else if (item.Type() == NGInlineItem::kAtomicInline) {
@@ -88,27 +87,26 @@
         continue;
       }
       bidi_runs->AddRun(run);
-      NGTextFragment fragment(constraint_space.WritingMode(),
-                              physical_fragment);
+      NGFragment fragment(constraint_space.WritingMode(), physical_fragment);
       // Store text fragments in a vector in the same order as BidiRunList.
       // One LayoutText may produce multiple text fragments that they can't
       // be set to a map.
       positions_for_bidi_runs_out->push_back(FragmentPosition{
           fragment.Offset() + parent_offset, fragment.InlineSize(),
-          physical_fragment->EndEffect()});
+          physical_fragment.EndEffect()});
     } else {
       DCHECK_EQ(child->Type(), NGPhysicalFragment::kFragmentBox);
-      NGPhysicalBoxFragment* physical_fragment =
-          ToNGPhysicalBoxFragment(child.Get());
-      NGBoxFragment fragment(constraint_space.WritingMode(), physical_fragment);
+      const auto& physical_fragment = ToNGPhysicalBoxFragment(*child);
+
+      NGFragment fragment(constraint_space.WritingMode(), physical_fragment);
       NGLogicalOffset child_offset = fragment.Offset() + parent_offset;
-      if (physical_fragment->Children().size()) {
-        CreateBidiRuns(bidi_runs, physical_fragment->Children(),
+      if (physical_fragment.Children().size()) {
+        CreateBidiRuns(bidi_runs, physical_fragment.Children(),
                        constraint_space, child_offset, items, text_offsets,
                        positions_for_bidi_runs_out, positions_out);
       } else {
         // An empty inline needs a BidiRun for itself.
-        LayoutObject* layout_object = physical_fragment->GetLayoutObject();
+        LayoutObject* layout_object = physical_fragment.GetLayoutObject();
         BidiRun* run = new BidiRun(0, 1, 0, LineLayoutItem(layout_object));
         bidi_runs->AddRun(run);
       }
@@ -640,13 +638,12 @@
     if (!container_child.Get()->IsLineBox())
       continue;
 
-    NGPhysicalLineBoxFragment* physical_line_box =
-        ToNGPhysicalLineBoxFragment(container_child.Get());
-    NGLineBoxFragment line_box(constraint_space.WritingMode(),
-                               physical_line_box);
+    const auto& physical_line_box =
+        ToNGPhysicalLineBoxFragment(*container_child);
+    NGFragment line_box(constraint_space.WritingMode(), physical_line_box);
 
     // Create a BidiRunList for this line.
-    CreateBidiRuns(&bidi_runs, physical_line_box->Children(), constraint_space,
+    CreateBidiRuns(&bidi_runs, physical_line_box.Children(), constraint_space,
                    {line_box.InlineOffset(), LayoutUnit(0)}, items,
                    text_offsets, &positions_for_bidi_runs, &positions);
     // TODO(kojii): bidi needs to find the logical last run.
@@ -678,7 +675,7 @@
     root_line_box->SetLogicalWidth(line_box.InlineSize());
     LayoutUnit line_top = line_box.BlockOffset() + border_padding.block_start;
     NGLineHeightMetrics line_metrics(Style(), baseline_type);
-    const NGLineHeightMetrics& max_with_leading = physical_line_box->Metrics();
+    const NGLineHeightMetrics& max_with_leading = physical_line_box.Metrics();
     LayoutUnit baseline = line_top + max_with_leading.ascent;
     root_line_box->SetLogicalTop(baseline - line_metrics.ascent);
     root_line_box->SetLineTopBottomPositions(

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_box_fragment.h b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_box_fragment.h
index e0f1f8d8..1e33e57 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_box_fragment.h
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_box_fragment.h

@@ -15,7 +15,7 @@
 class CORE_EXPORT NGLineBoxFragment final : public NGFragment {
  public:
   NGLineBoxFragment(NGWritingMode writing_mode,
-                    const NGPhysicalLineBoxFragment* physical_fragment)
+                    const NGPhysicalLineBoxFragment& physical_fragment)
       : NGFragment(writing_mode, physical_fragment) {}
 };
 

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.cc b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.cc
index 47de07a..20f0bac 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.cc
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.cc

@@ -336,6 +336,8 @@
   ShapingLineBreaker breaker(&shaper_, &item.Style()->GetFont(),
                              item.TextShapeResult(), &break_iterator_,
                              &spacing_, hyphenation_);
+  if (!enable_soft_hyphen_)
+    breaker.DisableSoftHyphen();
   available_width = std::max(LayoutUnit(0), available_width);
   ShapingLineBreaker::Result result;
   RefPtr<ShapeResult> shape_result =
@@ -456,10 +458,10 @@
           .ToConstraintSpace(FromPlatformWritingMode(style.GetWritingMode()));
   item_result->layout_result = node.Layout(*constraint_space);
 
+  DCHECK(item_result->layout_result->PhysicalFragment());
   item_result->inline_size =
-      NGBoxFragment(constraint_space_.WritingMode(),
-                    ToNGPhysicalBoxFragment(
-                        item_result->layout_result->PhysicalFragment().Get()))
+      NGFragment(constraint_space_.WritingMode(),
+                 *item_result->layout_result->PhysicalFragment())
           .InlineSize();
 
   item_result->margins =
@@ -768,7 +770,7 @@
     }
     break_iterator_.SetBreakAfterSpace(style.BreakOnlyAfterWhiteSpace());
 
-    // TODO(kojii): Implement 'hyphens: none'.
+    enable_soft_hyphen_ = style.GetHyphens() != Hyphens::kNone;
     hyphenation_ = style.GetHyphenation();
   }
 

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.h b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.h
index 2e9edb9..d6c13380 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.h
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker.h

@@ -152,6 +152,9 @@
 
   // True when current box has 'word-break/word-wrap: break-word'.
   bool break_if_overflow_ = false;
+
+  // True when breaking at soft hyphens (U+00AD) is allowed.
+  bool enable_soft_hyphen_ = true;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_text_fragment.h b/third_party/WebKit/Source/core/layout/ng/inline/ng_text_fragment.h
index 9ee213f..f8cb9a4 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_text_fragment.h
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_text_fragment.h

@@ -14,7 +14,7 @@
 class CORE_EXPORT NGTextFragment final : public NGFragment {
  public:
   NGTextFragment(NGWritingMode writing_mode,
-                 const NGPhysicalTextFragment* physical_text_fragment)
+                 const NGPhysicalTextFragment& physical_text_fragment)
       : NGFragment(writing_mode, physical_text_fragment) {}
 };
 

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc b/third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc
index 057137c..502dceb 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_layout_algorithm.cc

@@ -76,7 +76,7 @@
   // assume that its in the same writing mode as its parent, as a different
   // writing mode child will be caught by the CreatesNewFormattingContext check.
   NGFragment fragment(FromPlatformWritingMode(child.Style().GetWritingMode()),
-                      layout_result.PhysicalFragment().Get());
+                      *layout_result.PhysicalFragment());
   DCHECK_EQ(LayoutUnit(), fragment.BlockSize());
 #endif
 
@@ -660,11 +660,10 @@
   }
 
   // We must have an actual fragment at this stage.
-  DCHECK(layout_result->PhysicalFragment().Get());
+  DCHECK(layout_result->PhysicalFragment());
 
-  NGBoxFragment fragment(
-      ConstraintSpace().WritingMode(),
-      ToNGPhysicalBoxFragment(layout_result->PhysicalFragment().Get()));
+  NGFragment fragment(ConstraintSpace().WritingMode(),
+                      *layout_result->PhysicalFragment());
 
   NGLogicalOffset logical_offset =
       CalculateLogicalOffset(fragment, child_data.margins, child_bfc_offset);
@@ -802,9 +801,9 @@
     WTF::Optional<NGBfcOffset>* child_bfc_offset) {
   const EClear child_clear = child.Style().Clear();
 
-  NGBoxFragment fragment(
-      ConstraintSpace().WritingMode(),
-      ToNGPhysicalBoxFragment(layout_result.PhysicalFragment().Get()));
+  DCHECK(layout_result.PhysicalFragment());
+  NGFragment fragment(ConstraintSpace().WritingMode(),
+                      *layout_result.PhysicalFragment());
 
   LayoutUnit child_bfc_offset_estimate =
       child_data.bfc_offset_estimate.block_offset;

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
index 71accc5f..38d74b7a 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_node.cc

@@ -49,7 +49,7 @@
 void UpdateLegacyMultiColumnFlowThread(
     LayoutBox* layout_box,
     const NGConstraintSpace& constraint_space,
-    const NGPhysicalBoxFragment* fragment) {
+    const NGPhysicalBoxFragment& fragment) {
   LayoutBlockFlow* multicol = ToLayoutBlockFlow(layout_box);
   LayoutMultiColumnFlowThread* flow_thread = multicol->MultiColumnFlowThread();
   if (!flow_thread)
@@ -60,15 +60,14 @@
   LayoutUnit flow_end;
 
   // Stitch the columns together.
-  for (const RefPtr<NGPhysicalFragment> child : fragment->Children()) {
-    NGBoxFragment child_fragment(writing_mode,
-                                 ToNGPhysicalBoxFragment(child.Get()));
+  for (const RefPtr<NGPhysicalFragment> child : fragment.Children()) {
+    NGFragment child_fragment(writing_mode, *child);
     flow_end += child_fragment.BlockSize();
     column_inline_size = child_fragment.InlineSize();
   }
 
   if (LayoutMultiColumnSet* column_set = flow_thread->FirstMultiColumnSet()) {
-    NGBoxFragment logical_fragment(writing_mode, fragment);
+    NGFragment logical_fragment(writing_mode, fragment);
     column_set->SetLogicalWidth(logical_fragment.InlineSize());
     column_set->SetLogicalHeight(logical_fragment.BlockSize());
     column_set->EndFlow(flow_end);
@@ -93,7 +92,7 @@
   const auto* break_token = ToNGBlockBreakToken(fragment.BreakToken());
   if (!break_token)
     return true;
-  NGBoxFragment logical_fragment(constraint_space.WritingMode(), &fragment);
+  NGFragment logical_fragment(constraint_space.WritingMode(), fragment);
   return break_token->UsedBlockSize() <= logical_fragment.BlockSize();
 }
 
@@ -131,7 +130,7 @@
 
   if (layout_result->Status() == NGLayoutResult::kSuccess &&
       layout_result->UnpositionedFloats().IsEmpty())
-    CopyFragmentDataToLayoutBox(constraint_space, layout_result.Get());
+    CopyFragmentDataToLayoutBox(constraint_space, *layout_result);
 
   return layout_result;
 }
@@ -169,10 +168,9 @@
 
   // Have to synthesize this value.
   RefPtr<NGLayoutResult> layout_result = Layout(*constraint_space);
-  NGPhysicalFragment* physical_fragment =
-      layout_result->PhysicalFragment().Get();
-  NGBoxFragment min_fragment(FromPlatformWritingMode(Style().GetWritingMode()),
-                             ToNGPhysicalBoxFragment(physical_fragment));
+  NGBoxFragment min_fragment(
+      FromPlatformWritingMode(Style().GetWritingMode()),
+      ToNGPhysicalBoxFragment(*layout_result->PhysicalFragment()));
   sizes.min_size = min_fragment.OverflowSize().inline_size;
 
   // Now, redo with infinite space for max_content
@@ -186,9 +184,9 @@
           .ToConstraintSpace(FromPlatformWritingMode(Style().GetWritingMode()));
 
   layout_result = Layout(*constraint_space);
-  physical_fragment = layout_result->PhysicalFragment().Get();
-  NGBoxFragment max_fragment(FromPlatformWritingMode(Style().GetWritingMode()),
-                             ToNGPhysicalBoxFragment(physical_fragment));
+  NGBoxFragment max_fragment(
+      FromPlatformWritingMode(Style().GetWritingMode()),
+      ToNGPhysicalBoxFragment(*layout_result->PhysicalFragment()));
   sizes.max_size = max_fragment.OverflowSize().inline_size;
   return sizes;
 }
@@ -226,9 +224,11 @@
 
 void NGBlockNode::CopyFragmentDataToLayoutBox(
     const NGConstraintSpace& constraint_space,
-    NGLayoutResult* layout_result) {
-  const NGPhysicalBoxFragment* physical_fragment =
-      ToNGPhysicalBoxFragment(layout_result->PhysicalFragment().Get());
+    const NGLayoutResult& layout_result) {
+  DCHECK(layout_result.PhysicalFragment());
+  const NGPhysicalBoxFragment& physical_fragment =
+      ToNGPhysicalBoxFragment(*layout_result.PhysicalFragment());
+
   if (box_->Style()->SpecifiesColumns()) {
     UpdateLegacyMultiColumnFlowThread(box_, constraint_space,
                                       physical_fragment);
@@ -242,7 +242,7 @@
   // legacy layout doesn't support non-uniform fragmentainer widths.
   LayoutUnit logical_height;
   LayoutUnit intrinsic_content_logical_height;
-  if (IsFirstFragment(constraint_space, *physical_fragment)) {
+  if (IsFirstFragment(constraint_space, physical_fragment)) {
     box_->SetLogicalWidth(fragment.InlineSize());
   } else {
     DCHECK_EQ(box_->LogicalWidth(), fragment.InlineSize())
@@ -255,7 +255,7 @@
   NGBoxStrut border_scrollbar_padding =
       ComputeBorders(constraint_space, Style()) +
       ComputePadding(constraint_space, Style()) + GetScrollbarSizes(box_);
-  if (IsLastFragment(*physical_fragment))
+  if (IsLastFragment(physical_fragment))
     intrinsic_content_logical_height -= border_scrollbar_padding.BlockSum();
   box_->SetLogicalHeight(logical_height);
   box_->SetIntrinsicContentLogicalHeight(intrinsic_content_logical_height);
@@ -276,7 +276,7 @@
     box_->SetMarginEnd(margins.inline_end);
   }
 
-  for (const auto& child_fragment : physical_fragment->Children()) {
+  for (const auto& child_fragment : physical_fragment.Children()) {
     DCHECK(child_fragment->IsPlaced());
 
     // At the moment "anonymous" fragments for inline layout will have the same

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_block_node.h b/third_party/WebKit/Source/core/layout/ng/ng_block_node.h
index d9cebfb3c..97e2be63 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_block_node.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_block_node.h

@@ -59,7 +59,8 @@
  private:
   // After we run the layout algorithm, this function copies back the geometry
   // data to the layout box.
-  void CopyFragmentDataToLayoutBox(const NGConstraintSpace&, NGLayoutResult*);
+  void CopyFragmentDataToLayoutBox(const NGConstraintSpace&,
+                                   const NGLayoutResult&);
   void CopyChildFragmentPosition(
       const NGPhysicalFragment& fragment,
       const NGPhysicalOffset& additional_offset = NGPhysicalOffset());

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.cc b/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.cc
index 62c26da..b2b66ab 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.cc

@@ -12,18 +12,18 @@
 namespace blink {
 
 NGLogicalSize NGBoxFragment::OverflowSize() const {
-  auto* physical_fragment = ToNGPhysicalBoxFragment(physical_fragment_);
-  return physical_fragment->OverflowSize().ConvertToLogical(WritingMode());
+  const auto& physical_fragment = ToNGPhysicalBoxFragment(physical_fragment_);
+  return physical_fragment.OverflowSize().ConvertToLogical(WritingMode());
 }
 
 NGLineHeightMetrics NGBoxFragment::BaselineMetrics(
     const NGBaselineRequest& request) const {
-  LayoutBox* layout_box = ToLayoutBox(physical_fragment_->GetLayoutObject());
+  const auto& physical_fragment = ToNGPhysicalBoxFragment(physical_fragment_);
+
+  LayoutBox* layout_box = ToLayoutBox(physical_fragment_.GetLayoutObject());
 
   // Find the baseline from the computed results.
-  const NGPhysicalBoxFragment* physical_fragment =
-      ToNGPhysicalBoxFragment(physical_fragment_);
-  if (const NGBaseline* baseline = physical_fragment->Baseline(request)) {
+  if (const NGBaseline* baseline = physical_fragment.Baseline(request)) {
     LayoutUnit ascent = baseline->offset;
     LayoutUnit descent = BlockSize() - ascent;
 

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.h b/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.h
index 496074e0..776e7af 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_box_fragment.h

@@ -20,7 +20,7 @@
 class CORE_EXPORT NGBoxFragment final : public NGFragment {
  public:
   NGBoxFragment(NGWritingMode writing_mode,
-                const NGPhysicalBoxFragment* physical_fragment)
+                const NGPhysicalBoxFragment& physical_fragment)
       : NGFragment(writing_mode, physical_fragment) {}
 
   // Returns the total size, including the contents outside of the border-box.

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_column_layout_algorithm.cc b/third_party/WebKit/Source/core/layout/ng/ng_column_layout_algorithm.cc
index 35de5dc..47eee44 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_column_layout_algorithm.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_column_layout_algorithm.cc

@@ -56,7 +56,7 @@
     NGLogicalOffset logical_offset(column_inline_offset, LayoutUnit());
     container_builder_.AddChild(column, logical_offset);
 
-    NGLogicalSize size = NGBoxFragment(writing_mode, column.Get()).Size();
+    NGLogicalSize size = NGBoxFragment(writing_mode, *column).Size();
     NGLogicalOffset end_offset =
         logical_offset + NGLogicalOffset(size.inline_size, size.block_size);
 

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_floats_utils.cc b/third_party/WebKit/Source/core/layout/ng/ng_floats_utils.cc
index aedbf81..f6a4d6f 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_floats_utils.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_floats_utils.cc

@@ -154,9 +154,9 @@
   // the cached value.
   if (unpositioned_float->layout_result) {
     DCHECK(!is_same_writing_mode);
-    return NGFragment(
-               parent_space.WritingMode(),
-               unpositioned_float->layout_result->PhysicalFragment().Get())
+    DCHECK(unpositioned_float->layout_result->PhysicalFragment());
+    return NGFragment(parent_space.WritingMode(),
+                      *unpositioned_float->layout_result->PhysicalFragment())
         .InlineSize();
   }
 
@@ -183,10 +183,10 @@
   // unpositioned_float at this stage.
   unpositioned_float->layout_result = unpositioned_float->node.Layout(*space);
 
-  const NGPhysicalFragment* fragment =
-      unpositioned_float->layout_result->PhysicalFragment().Get();
+  DCHECK(unpositioned_float->layout_result->PhysicalFragment());
+  const auto& fragment = *unpositioned_float->layout_result->PhysicalFragment();
 
-  DCHECK(fragment->BreakToken()->IsFinished());
+  DCHECK(fragment.BreakToken()->IsFinished());
 
   return NGFragment(parent_space.WritingMode(), fragment).InlineSize();
 }
@@ -237,9 +237,9 @@
         *space, unpositioned_float->token.Get());
   }
 
-  NGBoxFragment float_fragment(
-      parent_space.WritingMode(),
-      ToNGPhysicalBoxFragment(layout_result.Get()->PhysicalFragment().Get()));
+  DCHECK(layout_result->PhysicalFragment());
+  NGFragment float_fragment(parent_space.WritingMode(),
+                            *layout_result->PhysicalFragment());
 
   // TODO(glebl): This should check for infinite opportunity instead.
   if (opportunity.IsEmpty()) {

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_fragment.cc b/third_party/WebKit/Source/core/layout/ng/ng_fragment.cc
index 72146fd..b91affb 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_fragment.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_fragment.cc

@@ -11,31 +11,31 @@
 
 LayoutUnit NGFragment::InlineSize() const {
   return writing_mode_ == kHorizontalTopBottom
-             ? physical_fragment_->Size().width
-             : physical_fragment_->Size().height;
+             ? physical_fragment_.Size().width
+             : physical_fragment_.Size().height;
 }
 
 LayoutUnit NGFragment::BlockSize() const {
   return writing_mode_ == kHorizontalTopBottom
-             ? physical_fragment_->Size().height
-             : physical_fragment_->Size().width;
+             ? physical_fragment_.Size().height
+             : physical_fragment_.Size().width;
 }
 
 NGLogicalSize NGFragment::Size() const {
-  return physical_fragment_->Size().ConvertToLogical(
+  return physical_fragment_.Size().ConvertToLogical(
       static_cast<NGWritingMode>(writing_mode_));
 }
 
 LayoutUnit NGFragment::InlineOffset() const {
   return writing_mode_ == kHorizontalTopBottom
-             ? physical_fragment_->Offset().left
-             : physical_fragment_->Offset().top;
+             ? physical_fragment_.Offset().left
+             : physical_fragment_.Offset().top;
 }
 
 LayoutUnit NGFragment::BlockOffset() const {
   return writing_mode_ == kHorizontalTopBottom
-             ? physical_fragment_->Offset().top
-             : physical_fragment_->Offset().left;
+             ? physical_fragment_.Offset().top
+             : physical_fragment_.Offset().left;
 }
 
 NGLogicalOffset NGFragment::Offset() const {
@@ -43,12 +43,12 @@
 }
 
 NGBorderEdges NGFragment::BorderEdges() const {
-  return NGBorderEdges::FromPhysical(physical_fragment_->BorderEdges(),
+  return NGBorderEdges::FromPhysical(physical_fragment_.BorderEdges(),
                                      WritingMode());
 }
 
 NGPhysicalFragment::NGFragmentType NGFragment::Type() const {
-  return physical_fragment_->Type();
+  return physical_fragment_.Type();
 }
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_fragment.h b/third_party/WebKit/Source/core/layout/ng/ng_fragment.h
index 4db4f44..331ee3d9 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_fragment.h
+++ b/third_party/WebKit/Source/core/layout/ng/ng_fragment.h

@@ -21,7 +21,7 @@
 
  public:
   NGFragment(NGWritingMode writing_mode,
-             const NGPhysicalFragment* physical_fragment)
+             const NGPhysicalFragment& physical_fragment)
       : physical_fragment_(physical_fragment), writing_mode_(writing_mode) {}
 
   NGWritingMode WritingMode() const {
@@ -43,7 +43,7 @@
   NGPhysicalFragment::NGFragmentType Type() const;
 
  protected:
-  const NGPhysicalFragment* physical_fragment_;
+  const NGPhysicalFragment& physical_fragment_;
 
   unsigned writing_mode_ : 3;
 };

diff --git a/third_party/WebKit/Source/core/layout/ng/ng_out_of_flow_layout_part.cc b/third_party/WebKit/Source/core/layout/ng/ng_out_of_flow_layout_part.cc
index 5f23061..fb4503a3 100644
--- a/third_party/WebKit/Source/core/layout/ng/ng_out_of_flow_layout_part.cc
+++ b/third_party/WebKit/Source/core/layout/ng/ng_out_of_flow_layout_part.cc

@@ -129,9 +129,9 @@
   if (AbsoluteNeedsChildBlockSize(descendant.Style())) {
     layout_result = GenerateFragment(descendant, block_estimate, node_position);
 
-    NGBoxFragment fragment(
-        descendant_writing_mode,
-        ToNGPhysicalBoxFragment(layout_result->PhysicalFragment().Get()));
+    DCHECK(layout_result->PhysicalFragment().Get());
+    NGFragment fragment(descendant_writing_mode,
+                        *layout_result->PhysicalFragment());
 
     block_estimate = fragment.BlockSize();
   }

diff --git a/third_party/WebKit/Source/core/scheduler/ThrottlingTest.cpp b/third_party/WebKit/Source/core/scheduler/ThrottlingTest.cpp
index 32679ca..cae8d1a 100644
--- a/third_party/WebKit/Source/core/scheduler/ThrottlingTest.cpp
+++ b/third_party/WebKit/Source/core/scheduler/ThrottlingTest.cpp

@@ -68,8 +68,7 @@
 
 class BackgroundRendererThrottlingTest : public SimTest {};
 
-TEST_F(BackgroundRendererThrottlingTest,
-       DISABLED_BackgroundRenderersAreThrottled) {
+TEST_F(BackgroundRendererThrottlingTest, BackgroundRenderersAreThrottled) {
   SimRequest main_resource("https://example.com/", "text/html");
 
   LoadURL("https://example.com/");

diff --git a/third_party/WebKit/Source/core/scheduler/VirtualTimeTest.cpp b/third_party/WebKit/Source/core/scheduler/VirtualTimeTest.cpp
index f6c58a7f..dd97c2869 100644
--- a/third_party/WebKit/Source/core/scheduler/VirtualTimeTest.cpp
+++ b/third_party/WebKit/Source/core/scheduler/VirtualTimeTest.cpp

@@ -72,6 +72,8 @@
 #endif
 TEST_F(VirtualTimeTest, MAYBE_DOMTimersFireInExpectedOrder) {
   WebView().Scheduler()->EnableVirtualTime();
+  WebView().Scheduler()->SetVirtualTimePolicy(
+      WebViewScheduler::VirtualTimePolicy::ADVANCE);
 
   ExecuteJavaScript(
       "var run_order = [];"
@@ -99,6 +101,8 @@
 #endif
 TEST_F(VirtualTimeTest, MAYBE_SetInterval) {
   WebView().Scheduler()->EnableVirtualTime();
+  WebView().Scheduler()->SetVirtualTimePolicy(
+      WebViewScheduler::VirtualTimePolicy::ADVANCE);
 
   ExecuteJavaScript(
       "var run_order = [];"
@@ -204,6 +208,8 @@
 #endif
 TEST_F(VirtualTimeTest, MAYBE_DOMTimersSuspended) {
   WebView().Scheduler()->EnableVirtualTime();
+  WebView().Scheduler()->SetVirtualTimePolicy(
+      WebViewScheduler::VirtualTimePolicy::ADVANCE);
 
   // Schedule normal DOM timers to run at 1s and 1.001s in the future.
   ExecuteJavaScript(

diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index 551b23da..f1058e4e 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

@@ -1969,9 +1969,9 @@
   return blink::VisiblePositionForIndex(node_index + offset, parent);
 }
 
-bool AXLayoutObject::OnNativeSetSelectionAction(const AXRange& selection) {
+void AXLayoutObject::SetSelection(const AXRange& selection) {
   if (!GetLayoutObject() || !selection.IsValid())
-    return false;
+    return;
 
   AXObject* anchor_object =
       selection.anchor_object ? selection.anchor_object.Get() : this;
@@ -1980,7 +1980,7 @@
 
   if (!IsValidSelectionBound(anchor_object) ||
       !IsValidSelectionBound(focus_object)) {
-    return false;
+    return;
   }
 
   // The selection offsets are offsets into the accessible value.
@@ -1998,12 +1998,12 @@
                                       selection.anchor_offset,
                                       kSelectionHasBackwardDirection);
     }
-    return true;
+    return;
   }
 
   LocalFrame* frame = GetLayoutObject()->GetFrame();
   if (!frame || !frame->Selection().IsAvailable())
-    return false;
+    return;
 
   // TODO(editing-dev): Use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  see http://crbug.com/590369 for more details.
@@ -2018,14 +2018,13 @@
   VisiblePosition focus_visible_position =
       ToVisiblePosition(focus_object, selection.focus_offset);
   if (anchor_visible_position.IsNull() || focus_visible_position.IsNull())
-    return false;
+    return;
 
   frame->Selection().SetSelection(
       SelectionInDOMTree::Builder()
           .Collapse(anchor_visible_position.ToPositionWithAffinity())
           .Extend(focus_visible_position.DeepEquivalent())
           .Build());
-  return true;
 }
 
 bool AXLayoutObject::IsValidSelectionBound(const AXObject* bound_object) const {
@@ -2036,26 +2035,19 @@
          &bound_object->AxObjectCache() == &AxObjectCache();
 }
 
-bool AXLayoutObject::OnNativeSetValueAction(const String& string) {
+void AXLayoutObject::SetValue(const String& string) {
   if (!GetNode() || !GetNode()->IsElementNode())
-    return false;
+    return;
   if (!layout_object_ || !layout_object_->IsBoxModelObject())
-    return false;
+    return;
 
   LayoutBoxModelObject* layout_object = ToLayoutBoxModelObject(layout_object_);
-  if (layout_object->IsTextField() && isHTMLInputElement(*GetNode())) {
+  if (layout_object->IsTextField() && isHTMLInputElement(*GetNode()))
     toHTMLInputElement(*GetNode())
         .setValue(string, kDispatchInputAndChangeEvent);
-    return true;
-  }
-
-  if (layout_object->IsTextArea() && isHTMLTextAreaElement(*GetNode())) {
+  else if (layout_object->IsTextArea() && isHTMLTextAreaElement(*GetNode()))
     toHTMLTextAreaElement(*GetNode())
         .setValue(string, kDispatchInputAndChangeEvent);
-    return true;
-  }
-
-  return false;
 }
 
 //

diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
index 85e2dfc..171672e 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h

@@ -140,13 +140,11 @@
                          AXRelatedObjectVector*,
                          NameSources*) const override;
 
-  // Modify or take an action on an object.
-  bool OnNativeSetSelectionAction(const AXRange&) override;
-  bool OnNativeSetValueAction(const String&) override;
-
   // Methods that retrieve or manipulate the current selection.
+
   AXRange Selection() const override;
   AXRange SelectionUnderObject() const override;
+  void SetSelection(const AXRange&) override;
 
   // Hit testing.
   AXObject* AccessibilityHitTest(const IntPoint&) const override;
@@ -177,6 +175,8 @@
   LocalFrameView* DocumentFrameView() const override;
   Element* AnchorElement() const override;
 
+  void SetValue(const String&) override;
+
   // Notifications that this object may have changed.
   void HandleActiveDescendantChanged() override;
   void HandleAriaExpandedChanged() override;

diff --git a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp
index bb2e373..bd0ae00 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp

@@ -136,20 +136,19 @@
   return text_alternative;
 }
 
-bool AXListBoxOption::OnNativeSetSelectedAction(bool selected) {
+void AXListBoxOption::SetSelected(bool selected) {
   HTMLSelectElement* select_element = ListBoxOptionParentNode();
   if (!select_element)
-    return false;
+    return;
 
   if (!CanSetSelectedAttribute())
-    return false;
+    return;
 
   bool is_option_selected = IsSelected();
   if ((is_option_selected && selected) || (!is_option_selected && !selected))
-    return false;
+    return;
 
   select_element->SelectOptionByAccessKey(toHTMLOptionElement(GetNode()));
-  return true;
 }
 
 HTMLSelectElement* AXListBoxOption::ListBoxOptionParentNode() const {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
index 77ddc4d2..fe29685 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h

@@ -52,7 +52,7 @@
   AccessibilityRole DetermineAccessibilityRole() final;
   bool IsSelected() const override;
   bool IsSelectedOptionActive() const override;
-  bool OnNativeSetSelectedAction(bool) override;
+  void SetSelected(bool) override;
 
   String TextAlternative(bool recursive,
                          bool in_aria_labelled_by_traversal,

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
index 240a30f..af728ec 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp

@@ -48,7 +48,7 @@
   return kPopUpButtonRole;
 }
 
-bool AXMenuList::OnNativeClickAction() {
+bool AXMenuList::Press() {
   if (!layout_object_)
     return false;
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuList.h b/third_party/WebKit/Source/modules/accessibility/AXMenuList.h
index 3d23c4843..e9285d3 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuList.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuList.h

@@ -41,7 +41,7 @@
 
   bool IsCollapsed() const override;
   AccessibilityExpanded IsExpanded() const final;
-  bool OnNativeClickAction() override;
+  bool Press() override;
   void ClearChildren() override;
 
   void DidUpdateActiveOption(int option_index);

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
index 7378afab..44b23cb1 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp

@@ -119,12 +119,11 @@
   return element_ && element_->Selected();
 }
 
-bool AXMenuListOption::OnNativeSetSelectedAction(bool b) {
+void AXMenuListOption::SetSelected(bool b) {
   if (!element_ || !CanSetSelectedAttribute())
-    return false;
+    return;
 
   element_->SetSelected(b);
-  return true;
 }
 
 bool AXMenuListOption::ComputeAccessibilityIsIgnored(

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h
index c5135fd..07512b2b 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h

@@ -61,7 +61,7 @@
   bool IsVisible() const override;
   bool IsOffScreen() const override;
   bool IsSelected() const override;
-  bool OnNativeSetSelectedAction(bool) override;
+  void SetSelected(bool) override;
 
   void GetRelativeBounds(AXObject** out_container,
                          FloatRect& out_bounds_in_container,

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp
index bca7bbf..41effbaf 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.cpp

@@ -81,11 +81,12 @@
   return html_select_element->selectedIndex();
 }
 
-bool AXMenuListPopup::OnNativeClickAction() {
+bool AXMenuListPopup::Press() {
   if (!parent_)
     return false;
 
-  return parent_->OnNativeClickAction();
+  parent_->Press();
+  return true;
 }
 
 void AXMenuListPopup::AddChildren() {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h
index 6252ef7..d57e5870 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListPopup.h

@@ -59,7 +59,7 @@
   AccessibilityRole RoleValue() const override { return kMenuListPopupRole; }
 
   bool IsVisible() const override;
-  bool OnNativeClickAction() override;
+  bool Press() override;
   void AddChildren() override;
   bool ComputeAccessibilityIsIgnored(IgnoredReasons* = nullptr) const override;
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
index 4f745aa..8648838 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

@@ -341,7 +341,7 @@
 
   value += increase ? step : -step;
 
-  OnNativeSetValueAction(String::Number(value));
+  SetValue(String::Number(value));
   AxObjectCache().PostNotification(GetNode(),
                                    AXObjectCacheImpl::kAXValueChanged);
 }
@@ -2545,57 +2545,50 @@
   return Traversal<HTMLLabelElement>::FirstAncestorOrSelf(*GetNode());
 }
 
-bool AXNodeObject::OnNativeFocusAction() {
+void AXNodeObject::SetFocused(bool on) {
   if (!CanSetFocusAttribute())
-    return false;
+    return;
 
-  Document* document = GetDocument();
-  if (IsWebArea()) {
+  Document* document = this->GetDocument();
+  if (!on) {
     document->ClearFocusedElement();
-    return true;
+  } else {
+    Node* node = this->GetNode();
+    if (node && node->IsElementNode()) {
+      // If this node is already the currently focused node, then calling
+      // focus() won't do anything.  That is a problem when focus is removed
+      // from the webpage to chrome, and then returns.  In these cases, we need
+      // to do what keyboard and mouse focus do, which is reset focus first.
+      if (document->FocusedElement() == node)
+        document->ClearFocusedElement();
+
+      ToElement(node)->focus();
+    } else {
+      document->ClearFocusedElement();
+    }
   }
-
-  Element* element = GetElement();
-  if (!element) {
-    document->ClearFocusedElement();
-    return true;
-  }
-
-  // If this node is already the currently focused node, then calling
-  // focus() won't do anything.  That is a problem when focus is removed
-  // from the webpage to chrome, and then returns.  In these cases, we need
-  // to do what keyboard and mouse focus do, which is reset focus first.
-  if (document->FocusedElement() == element)
-    document->ClearFocusedElement();
-
-  element->focus();
-  return true;
 }
 
-bool AXNodeObject::OnNativeIncrementAction() {
+void AXNodeObject::Increment() {
   LocalFrame* frame = GetDocument() ? GetDocument()->GetFrame() : nullptr;
   std::unique_ptr<UserGestureIndicator> gesture_indicator =
       LocalFrame::CreateUserGesture(frame, UserGestureToken::kNewGesture);
   AlterSliderValue(true);
-  return true;
 }
 
-bool AXNodeObject::OnNativeDecrementAction() {
+void AXNodeObject::Decrement() {
   LocalFrame* frame = GetDocument() ? GetDocument()->GetFrame() : nullptr;
   std::unique_ptr<UserGestureIndicator> gesture_indicator =
       LocalFrame::CreateUserGesture(frame, UserGestureToken::kNewGesture);
   AlterSliderValue(false);
-  return true;
 }
 
-bool AXNodeObject::OnNativeSetSequentialFocusNavigationStartingPointAction() {
+void AXNodeObject::SetSequentialFocusNavigationStartingPoint() {
   if (!GetNode())
-    return false;
+    return;
 
-  Document* document = GetDocument();
-  document->ClearFocusedElement();
-  document->SetSequentialFocusNavigationStartingPoint(GetNode());
-  return true;
+  GetNode()->GetDocument().ClearFocusedElement();
+  GetNode()->GetDocument().SetSequentialFocusNavigationStartingPoint(GetNode());
 }
 
 void AXNodeObject::ChildrenChanged() {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
index c8c8110..5e3d831 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h

@@ -204,10 +204,10 @@
   Node* GetNode() const override { return node_; }
 
   // Modify or take an action on an object.
-  bool OnNativeFocusAction() final;
-  bool OnNativeIncrementAction() final;
-  bool OnNativeDecrementAction() final;
-  bool OnNativeSetSequentialFocusNavigationStartingPointAction() final;
+  void SetFocused(bool) final;
+  void Increment() final;
+  void Decrement() final;
+  void SetSequentialFocusNavigationStartingPoint() final;
 
   // Notifications that this object may have changed.
   void ChildrenChanged() override;

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
index 70e5931..a525d30 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.cpp

@@ -42,8 +42,6 @@
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/html/HTMLInputElement.h"
 #include "core/html/parser/HTMLParserIdioms.h"
-#include "core/input/ContextMenuAllowedScope.h"
-#include "core/input/EventHandler.h"
 #include "core/layout/LayoutBoxModelObject.h"
 #include "core/layout/LayoutView.h"
 #include "core/page/Page.h"
@@ -1798,30 +1796,11 @@
 // Modify or take an action on an object.
 //
 
-bool AXObject::RequestDecrementAction() {
-  Element* element = GetElement();
-  if (element) {
-    Event* event = Event::CreateCancelable(EventTypeNames::accessibledecrement);
-    if (DispatchEventToAOMEventListeners(*event, element)) {
-      return true;
-    }
-  }
-
-  return OnNativeDecrementAction();
+bool AXObject::PerformDefaultAction() {
+  return Press();
 }
 
-bool AXObject::RequestClickAction() {
-  Element* element = GetElement();
-  if (element) {
-    Event* event = Event::CreateCancelable(EventTypeNames::accessibleclick);
-    if (DispatchEventToAOMEventListeners(*event, element))
-      return true;
-  }
-
-  return OnNativeClickAction();
-}
-
-bool AXObject::OnNativeClickAction() {
+bool AXObject::Press() {
   Document* document = GetDocument();
   if (!document)
     return false;
@@ -1830,93 +1809,29 @@
       LocalFrame::CreateUserGesture(document->GetFrame(),
                                     UserGestureToken::kNewGesture);
   Element* action_elem = ActionElement();
+  Event* event = Event::CreateCancelable(EventTypeNames::accessibleclick);
+  if (DispatchEventToAOMEventListeners(*event, action_elem)) {
+    return true;
+  }
+
   if (action_elem) {
     action_elem->AccessKeyAction(true);
     return true;
   }
 
-  if (CanSetFocusAttribute())
-    return OnNativeFocusAction();
+  if (CanSetFocusAttribute()) {
+    SetFocused(true);
+    return true;
+  }
 
   return false;
 }
 
-bool AXObject::RequestFocusAction() {
-  Element* element = GetElement();
-  if (element) {
-    Event* event = Event::CreateCancelable(EventTypeNames::accessiblefocus);
-    if (DispatchEventToAOMEventListeners(*event, element))
-      return true;
-  }
-
-  return OnNativeFocusAction();
-}
-
-bool AXObject::RequestIncrementAction() {
-  Element* element = GetElement();
-  if (element) {
-    Event* event = Event::CreateCancelable(EventTypeNames::accessibleincrement);
-    if (DispatchEventToAOMEventListeners(*event, element))
-      return true;
-  }
-
-  return OnNativeIncrementAction();
-}
-
-bool AXObject::RequestScrollToGlobalPointAction(const IntPoint& point) {
-  return OnNativeScrollToGlobalPointAction(point);
-}
-
-bool AXObject::RequestScrollToMakeVisibleAction() {
-  Element* element = GetElement();
-  if (element) {
-    Event* event =
-        Event::CreateCancelable(EventTypeNames::accessiblescrollintoview);
-    if (DispatchEventToAOMEventListeners(*event, element))
-      return true;
-  }
-
-  return OnNativeScrollToMakeVisibleAction();
-}
-
-bool AXObject::RequestScrollToMakeVisibleWithSubFocusAction(
-    const IntRect& subfocus) {
-  return OnNativeScrollToMakeVisibleWithSubFocusAction(subfocus);
-}
-
-bool AXObject::RequestSetSelectedAction(bool selected) {
-  return OnNativeSetSelectedAction(selected);
-}
-
-bool AXObject::RequestSetSelectionAction(const AXRange& range) {
-  return OnNativeSetSelectionAction(range);
-}
-
-bool AXObject::RequestSetSequentialFocusNavigationStartingPointAction() {
-  return OnNativeSetSequentialFocusNavigationStartingPointAction();
-}
-
-bool AXObject::RequestSetValueAction(const String& value) {
-  return OnNativeSetValueAction(value);
-}
-
-bool AXObject::RequestShowContextMenuAction() {
-  Element* element = GetElement();
-  if (element) {
-    Event* event =
-        Event::CreateCancelable(EventTypeNames::accessiblecontextmenu);
-    if (DispatchEventToAOMEventListeners(*event, element))
-      return true;
-  }
-
-  return OnNativeShowContextMenuAction();
-}
-
-bool AXObject::OnNativeScrollToMakeVisibleAction() const {
+void AXObject::ScrollToMakeVisible() const {
   Node* node = GetNode();
   LayoutObject* layout_object = node ? node->GetLayoutObject() : nullptr;
   if (!layout_object || !node->isConnected())
-    return false;
+    return;
   LayoutRect target_rect(layout_object->AbsoluteBoundingBoxRect());
   layout_object->ScrollRectToVisible(
       target_rect, ScrollAlignment::kAlignCenterIfNeeded,
@@ -1926,15 +1841,13 @@
   AxObjectCache().PostNotification(
       AxObjectCache().GetOrCreate(GetDocument()->GetLayoutView()),
       AXObjectCacheImpl::kAXLocationChanged);
-  return true;
 }
 
-bool AXObject::OnNativeScrollToMakeVisibleWithSubFocusAction(
-    const IntRect& rect) const {
+void AXObject::ScrollToMakeVisibleWithSubFocus(const IntRect& rect) const {
   Node* node = GetNode();
   LayoutObject* layout_object = node ? node->GetLayoutObject() : nullptr;
   if (!layout_object || !node->isConnected())
-    return false;
+    return;
   LayoutRect target_rect(
       layout_object->LocalToAbsoluteQuad(FloatQuad(FloatRect(rect)))
           .BoundingBox());
@@ -1952,15 +1865,13 @@
   AxObjectCache().PostNotification(
       AxObjectCache().GetOrCreate(GetDocument()->GetLayoutView()),
       AXObjectCacheImpl::kAXLocationChanged);
-  return true;
 }
 
-bool AXObject::OnNativeScrollToGlobalPointAction(
-    const IntPoint& global_point) const {
+void AXObject::ScrollToGlobalPoint(const IntPoint& global_point) const {
   Node* node = GetNode();
   LayoutObject* layout_object = node ? node->GetLayoutObject() : nullptr;
   if (!layout_object || !node->isConnected())
-    return false;
+    return;
   LayoutRect target_rect(layout_object->AbsoluteBoundingBoxRect());
   target_rect.MoveBy(-global_point);
   layout_object->ScrollRectToVisible(
@@ -1971,57 +1882,13 @@
   AxObjectCache().PostNotification(
       AxObjectCache().GetOrCreate(GetDocument()->GetLayoutView()),
       AXObjectCacheImpl::kAXLocationChanged);
-  return true;
 }
 
-bool AXObject::OnNativeSetSequentialFocusNavigationStartingPointAction() {
+void AXObject::SetSequentialFocusNavigationStartingPoint() {
   // Call it on the nearest ancestor that overrides this with a specific
   // implementation.
-  if (ParentObject()) {
-    return ParentObject()
-        ->OnNativeSetSequentialFocusNavigationStartingPointAction();
-  }
-  return false;
-}
-
-bool AXObject::OnNativeDecrementAction() {
-  return false;
-}
-
-bool AXObject::OnNativeFocusAction() {
-  return false;
-}
-
-bool AXObject::OnNativeIncrementAction() {
-  return false;
-}
-
-bool AXObject::OnNativeSetValueAction(const String&) {
-  return false;
-}
-
-bool AXObject::OnNativeSetSelectedAction(bool) {
-  return false;
-}
-
-bool AXObject::OnNativeSetSelectionAction(const AXRange& range) {
-  return false;
-}
-
-bool AXObject::OnNativeShowContextMenuAction() {
-  Element* element = GetElement();
-  if (!element)
-    element = ParentObject() ? ParentObject()->GetElement() : nullptr;
-  if (!element)
-    return false;
-
-  Document* document = GetDocument();
-  if (!document || !document->GetFrame())
-    return false;
-
-  ContextMenuAllowedScope scope;
-  document->GetFrame()->GetEventHandler().ShowNonLocatedContextMenu(element);
-  return true;
+  if (ParentObject())
+    ParentObject()->SetSequentialFocusNavigationStartingPoint();
 }
 
 void AXObject::NotifyIfIgnoredValueChanged() {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.h b/third_party/WebKit/Source/modules/accessibility/AXObject.h
index 11fb399..c67fd869 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.h

@@ -752,6 +752,7 @@
   // current object as the starting point. Returns a null selection if there is
   // no selection in the subtree rooted at this object.
   virtual AXRange SelectionUnderObject() const { return AXRange(); }
+  virtual void SetSelection(const AXRange&) {}
 
   // Scrollable containers.
   bool IsScrollableContainer() const;
@@ -764,44 +765,24 @@
   virtual ScrollableArea* GetScrollableAreaIfScrollable() const { return 0; }
 
   // Modify or take an action on an object.
-  //
-  // These are the public interfaces, called from outside of Blink.
-  // Each one first tries to fire an Accessibility Object Model event,
-  // if applicable, and if that isn't handled, falls back on the
-  // native implementation via a virtual member function, below.
-  //
-  // For example, |RequestIncrementAction| fires the AOM event and if
-  // that isn't handled it calls |DoNativeIncrement|.
-  //
-  // These all return true if handled.
-  bool RequestDecrementAction();
-  bool RequestClickAction();
-  bool RequestFocusAction();
-  bool RequestIncrementAction();
-  bool RequestScrollToGlobalPointAction(const IntPoint&);
-  bool RequestScrollToMakeVisibleAction();
-  bool RequestScrollToMakeVisibleWithSubFocusAction(const IntRect&);
-  bool RequestSetSelectedAction(bool);
-  bool RequestSetSelectionAction(const AXRange&);
-  bool RequestSetSequentialFocusNavigationStartingPointAction();
-  bool RequestSetValueAction(const String&);
-  bool RequestShowContextMenuAction();
-
-  // Native implementations of actions that aren't handled by AOM
-  // event listeners. These all return true if handled.
-  virtual bool OnNativeDecrementAction();
-  virtual bool OnNativeClickAction();
-  virtual bool OnNativeFocusAction();
-  virtual bool OnNativeIncrementAction();
-  virtual bool OnNativeScrollToGlobalPointAction(const IntPoint&) const;
-  virtual bool OnNativeScrollToMakeVisibleAction() const;
-  virtual bool OnNativeScrollToMakeVisibleWithSubFocusAction(
-      const IntRect&) const;
-  virtual bool OnNativeSetSelectedAction(bool);
-  virtual bool OnNativeSetSelectionAction(const AXRange&);
-  virtual bool OnNativeSetSequentialFocusNavigationStartingPointAction();
-  virtual bool OnNativeSetValueAction(const String&);
-  virtual bool OnNativeShowContextMenuAction();
+  virtual void Increment() {}
+  virtual void Decrement() {}
+  bool PerformDefaultAction();
+  virtual bool Press();
+  // Make this object visible by scrolling as many nested scrollable views as
+  // needed.
+  void ScrollToMakeVisible() const;
+  // Same, but if the whole object can't be made visible, try for this subrect,
+  // in local coordinates.
+  void ScrollToMakeVisibleWithSubFocus(const IntRect&) const;
+  // Scroll this object to a given point in global coordinates of the top-level
+  // window.
+  void ScrollToGlobalPoint(const IntPoint&) const;
+  virtual void SetFocused(bool) {}
+  virtual void SetSelected(bool) {}
+  virtual void SetSequentialFocusNavigationStartingPoint();
+  virtual void SetValue(const String&) {}
+  virtual void SetValue(float) {}
 
   // Notifications that this object may have changed.
   virtual void ChildrenChanged() {}

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp b/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp
index 6c4e6a3a..3ce35cba 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXSlider.cpp

@@ -110,17 +110,16 @@
   return AxObjectCache().GetOrCreate(layout_object_);
 }
 
-bool AXSlider::OnNativeSetValueAction(const String& value) {
+void AXSlider::SetValue(const String& value) {
   HTMLInputElement* input = GetInputElement();
 
   if (input->value() == value)
-    return false;
+    return;
 
   input->setValue(value, kDispatchInputAndChangeEvent);
 
   // Fire change event manually, as LayoutSlider::setValueForPosition does.
   input->DispatchFormControlChangeEvent();
-  return true;
 }
 
 HTMLInputElement* AXSlider::GetInputElement() const {

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSlider.h b/third_party/WebKit/Source/modules/accessibility/AXSlider.h
index f5cd98a1..3068f60 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSlider.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXSlider.h

@@ -57,7 +57,7 @@
 
   void AddChildren() final;
 
-  bool OnNativeSetValueAction(const String&) final;
+  void SetValue(const String&) final;
   AccessibilityOrientation Orientation() const final;
 };
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSpinButton.cpp b/third_party/WebKit/Source/modules/accessibility/AXSpinButton.cpp
index 6a24333..1e8e30c 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSpinButton.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXSpinButton.cpp

@@ -128,7 +128,7 @@
   *out_container = ParentObject();
 }
 
-bool AXSpinButtonPart::OnNativeClickAction() {
+bool AXSpinButtonPart::Press() {
   if (!parent_ || !parent_->IsSpinButton())
     return false;
 

diff --git a/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h b/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h
index a440bd9..85fcad8 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXSpinButton.h

@@ -70,7 +70,7 @@
   explicit AXSpinButtonPart(AXObjectCacheImpl&);
   bool is_incrementor_ : 1;
 
-  bool OnNativeClickAction() override;
+  bool Press() override;
   AccessibilityRole RoleValue() const override { return kButtonRole; }
   bool IsSpinButtonPart() const override { return true; }
   void GetRelativeBounds(AXObject** out_container,

diff --git a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp
index d156b19..c1ba78e0 100644
--- a/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp
+++ b/third_party/WebKit/Source/modules/device_orientation/DeviceOrientationData.cpp

@@ -70,7 +70,7 @@
   return DeviceOrientationData::Create(alpha, beta, gamma, data.absolute);
 }
 
-DeviceOrientationData::DeviceOrientationData() {}
+DeviceOrientationData::DeviceOrientationData() : absolute_(false) {}
 
 DeviceOrientationData::DeviceOrientationData(const Nullable<double>& alpha,
                                              const Nullable<double>& beta,

diff --git a/third_party/WebKit/Source/modules/exported/WebAXObject.cpp b/third_party/WebKit/Source/modules/exported/WebAXObject.cpp
index 01a1dfd..89ef94e 100644
--- a/third_party/WebKit/Source/modules/exported/WebAXObject.cpp
+++ b/third_party/WebKit/Source/modules/exported/WebAXObject.cpp

@@ -179,6 +179,20 @@
   return static_cast<WebAXDefaultActionVerb>(private_->Action());
 }
 
+bool WebAXObject::CanDecrement() const {
+  if (IsDetached())
+    return false;
+
+  return private_->IsSlider();
+}
+
+bool WebAXObject::CanIncrement() const {
+  if (IsDetached())
+    return false;
+
+  return private_->IsSlider();
+}
+
 bool WebAXObject::CanPress() const {
   if (IsDetached())
     return false;
@@ -691,25 +705,33 @@
   return private_->Language();
 }
 
-bool WebAXObject::Click() const {
+bool WebAXObject::PerformDefaultAction() const {
   if (IsDetached())
     return false;
 
-  return private_->RequestClickAction();
+  return private_->PerformDefaultAction();
 }
 
 bool WebAXObject::Increment() const {
   if (IsDetached())
     return false;
 
-  return private_->RequestIncrementAction();
+  if (CanIncrement()) {
+    private_->Increment();
+    return true;
+  }
+  return false;
 }
 
 bool WebAXObject::Decrement() const {
   if (IsDetached())
     return false;
 
-  return private_->RequestDecrementAction();
+  if (CanDecrement()) {
+    private_->Decrement();
+    return true;
+  }
+  return false;
 }
 
 WebAXObject WebAXObject::InPageLinkTarget() const {
@@ -728,6 +750,13 @@
   return static_cast<WebAXOrientation>(private_->Orientation());
 }
 
+bool WebAXObject::Press() const {
+  if (IsDetached())
+    return false;
+
+  return private_->Press();
+}
+
 WebVector<WebAXObject> WebAXObject::RadioButtonsInGroup() const {
   if (IsDetached())
     return WebVector<WebAXObject>();
@@ -773,24 +802,18 @@
   return;
 }
 
-bool WebAXObject::SetSelected(bool selected) const {
-  if (IsDetached())
-    return false;
-
-  return private_->RequestSetSelectedAction(selected);
-}
-
-bool WebAXObject::SetSelection(const WebAXObject& anchor_object,
+void WebAXObject::SetSelection(const WebAXObject& anchor_object,
                                int anchor_offset,
                                const WebAXObject& focus_object,
                                int focus_offset) const {
   if (IsDetached())
-    return false;
+    return;
 
   AXObject::AXRange ax_selection(anchor_object, anchor_offset,
                                  TextAffinity::kUpstream, focus_object,
                                  focus_offset, TextAffinity::kDownstream);
-  return private_->RequestSetSelectionAction(ax_selection);
+  private_->SetSelection(ax_selection);
+  return;
 }
 
 unsigned WebAXObject::SelectionEnd() const {
@@ -840,32 +863,67 @@
   return line_number;
 }
 
-bool WebAXObject::Focus() const {
-  if (IsDetached())
-    return false;
-
-  return private_->RequestFocusAction();
+void WebAXObject::SetFocused(bool on) const {
+  if (!IsDetached())
+    private_->SetFocused(on);
 }
 
-bool WebAXObject::SetSequentialFocusNavigationStartingPoint() const {
+void WebAXObject::SetSelectedTextRange(int selection_start,
+                                       int selection_end) const {
   if (IsDetached())
-    return false;
+    return;
 
-  return private_->RequestSetSequentialFocusNavigationStartingPointAction();
+  private_->SetSelection(AXObject::AXRange(selection_start, selection_end));
 }
 
-bool WebAXObject::SetValue(WebString value) const {
+void WebAXObject::SetSequentialFocusNavigationStartingPoint() const {
   if (IsDetached())
-    return false;
+    return;
 
-  return private_->RequestSetValueAction(value);
+  private_->SetSequentialFocusNavigationStartingPoint();
 }
 
-bool WebAXObject::ShowContextMenu() const {
+void WebAXObject::SetValue(WebString value) const {
   if (IsDetached())
-    return false;
+    return;
 
-  return private_->RequestShowContextMenuAction();
+  private_->SetValue(value);
+}
+
+void WebAXObject::ShowContextMenu() const {
+  if (IsDetached())
+    return;
+
+  Node* node = private_->GetNode();
+  if (!node)
+    return;
+
+  Element* element = nullptr;
+  if (node->IsElementNode()) {
+    element = ToElement(node);
+  } else if (node->IsDocumentNode()) {
+    element = node->GetDocument().documentElement();
+  } else {
+    node->UpdateDistribution();
+    ContainerNode* parent = FlatTreeTraversal::Parent(*node);
+    if (!parent)
+      return;
+    SECURITY_DCHECK(parent->IsElementNode());
+    element = ToElement(parent);
+  }
+
+  if (!element)
+    return;
+
+  LocalFrame* frame = element->GetDocument().GetFrame();
+  if (!frame)
+    return;
+
+  WebViewImpl* view = WebLocalFrameImpl::FromFrame(frame)->ViewImpl();
+  if (!view)
+    return;
+
+  view->ShowContextMenuForElement(WebElement(element));
 }
 
 WebString WebAXObject::StringValue() const {
@@ -1449,26 +1507,20 @@
   bounds_in_container = WebFloatRect(bounds);
 }
 
-bool WebAXObject::ScrollToMakeVisible() const {
-  if (IsDetached())
-    return false;
-
-  return private_->RequestScrollToMakeVisibleAction();
+void WebAXObject::ScrollToMakeVisible() const {
+  if (!IsDetached())
+    private_->ScrollToMakeVisible();
 }
 
-bool WebAXObject::ScrollToMakeVisibleWithSubFocus(
+void WebAXObject::ScrollToMakeVisibleWithSubFocus(
     const WebRect& subfocus) const {
-  if (IsDetached())
-    return false;
-
-  return private_->RequestScrollToMakeVisibleWithSubFocusAction(subfocus);
+  if (!IsDetached())
+    private_->ScrollToMakeVisibleWithSubFocus(subfocus);
 }
 
-bool WebAXObject::ScrollToGlobalPoint(const WebPoint& point) const {
-  if (IsDetached())
-    return false;
-
-  return private_->RequestScrollToGlobalPointAction(point);
+void WebAXObject::ScrollToGlobalPoint(const WebPoint& point) const {
+  if (!IsDetached())
+    private_->ScrollToGlobalPoint(point);
 }
 
 WebAXObject::WebAXObject(AXObject* object) : private_(object) {}

diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp
index 57b4bb4d..15c7f862 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsOrientationLockDelegateTest.cpp

@@ -374,6 +374,12 @@
     // Set video size.
     EXPECT_CALL(MockWebMediaPlayer(), NaturalSize())
         .WillRepeatedly(Return(WebSize(video_width, video_height)));
+
+    // Dispatch an arbitrary Device Orientation event to satisfy
+    // MediaControlsRotateToFullscreenDelegate's requirement that the device
+    // supports the API and can provide beta and gamma values. The orientation
+    // will be ignored.
+    RotateDeviceTo(0);
   }
 
   void PlayVideo() {

diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp
index 8fe4ad2..96e74a2f 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.cpp

@@ -11,6 +11,8 @@
 #include "core/fullscreen/Fullscreen.h"
 #include "core/html/HTMLVideoElement.h"
 #include "core/page/ChromeClient.h"
+#include "modules/device_orientation/DeviceOrientationData.h"
+#include "modules/device_orientation/DeviceOrientationEvent.h"
 #include "modules/media_controls/MediaControlsImpl.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebScreenInfo.h"
@@ -52,6 +54,7 @@
   // TODO(johnme): Check this is battery efficient (note that this doesn't need
   // to receive events for 180 deg rotations).
   dom_window->addEventListener(EventTypeNames::orientationchange, this, false);
+  dom_window->addEventListener(EventTypeNames::deviceorientation, this, false);
 }
 
 void MediaControlsRotateToFullscreenDelegate::Detach() {
@@ -77,6 +80,8 @@
     return;
   dom_window->removeEventListener(EventTypeNames::orientationchange, this,
                                   false);
+  dom_window->removeEventListener(EventTypeNames::deviceorientation, this,
+                                  false);
 }
 
 bool MediaControlsRotateToFullscreenDelegate::operator==(
@@ -94,6 +99,10 @@
     OnStateChange();
     return;
   }
+  if (event->type() == EventTypeNames::deviceorientation) {
+    OnDeviceOrientationAvailable(ToDeviceOrientationEvent(event));
+    return;
+  }
   if (event->type() == EventTypeNames::orientationchange) {
     OnScreenOrientationChange();
     return;
@@ -129,6 +138,21 @@
   is_visible_ = is_visible;
 }
 
+void MediaControlsRotateToFullscreenDelegate::OnDeviceOrientationAvailable(
+    DeviceOrientationEvent* event) {
+  LocalDOMWindow* dom_window = video_element_->GetDocument().domWindow();
+  if (!dom_window)
+    return;
+  // Stop listening after the first event. Just need to know if it's available.
+  dom_window->removeEventListener(EventTypeNames::deviceorientation, this,
+                                  false);
+
+  // MediaControlsOrientationLockDelegate needs beta and gamma only.
+  DeviceOrientationData* data = event->Orientation();
+  device_orientation_supported_ =
+      WTF::make_optional(data->CanProvideBeta() && data->CanProvideGamma());
+}
+
 void MediaControlsRotateToFullscreenDelegate::OnScreenOrientationChange() {
   SimpleOrientation previous_screen_orientation = current_screen_orientation_;
   current_screen_orientation_ = ComputeScreenOrientation();
@@ -139,6 +163,13 @@
   if (!video_element_->ShouldShowControls())
     return;
 
+  // Only enable if the Device Orientation API can provide beta and gamma values
+  // that will be needed for MediaControlsOrientationLockDelegate to
+  // automatically unlock, such that it will be possible to exit fullscreen by
+  // rotating back to the previous orientation.
+  if (!device_orientation_supported_.value_or(false))
+    return;
+
   // Don't enter/exit fullscreen if some other element is fullscreen.
   Element* fullscreen_element =
       Fullscreen::FullscreenElementFrom(video_element_->GetDocument());

diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.h b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.h
index 3adef1d..4610a4a 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.h
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegate.h

@@ -7,9 +7,11 @@
 
 #include "core/dom/events/EventListener.h"
 #include "modules/ModulesExport.h"
+#include "platform/wtf/Optional.h"
 
 namespace blink {
 
+class DeviceOrientationEvent;
 class HTMLVideoElement;
 class ElementVisibilityObserver;
 
@@ -46,11 +48,14 @@
 
   void OnStateChange();
   void OnVisibilityChange(bool is_visible);
+  void OnDeviceOrientationAvailable(DeviceOrientationEvent*);
   void OnScreenOrientationChange();
 
   MODULES_EXPORT SimpleOrientation ComputeVideoOrientation() const;
   SimpleOrientation ComputeScreenOrientation() const;
 
+  WTF::Optional<bool> device_orientation_supported_;
+
   SimpleOrientation current_screen_orientation_ = SimpleOrientation::kUnknown;
 
   // Only valid when visibility_observer_ is active and the first

diff --git a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp
index 5524e8d..b848c558 100644
--- a/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp
+++ b/third_party/WebKit/Source/modules/media_controls/MediaControlsRotateToFullscreenDelegateTest.cpp

@@ -17,6 +17,8 @@
 #include "core/html/HTMLVideoElement.h"
 #include "core/loader/EmptyClients.h"
 #include "core/testing/DummyPageHolder.h"
+#include "modules/device_orientation/DeviceOrientationController.h"
+#include "modules/device_orientation/DeviceOrientationData.h"
 #include "modules/media_controls/MediaControlsImpl.h"
 #include "modules/screen_orientation/ScreenOrientationControllerImpl.h"
 #include "platform/testing/EmptyWebMediaPlayer.h"
@@ -164,7 +166,8 @@
   }
 
   void InitScreenAndVideo(WebScreenOrientationType initial_screen_orientation,
-                          WebSize video_size);
+                          WebSize video_size,
+                          bool with_device_orientation = true);
 
   void PlayVideo();
 
@@ -198,7 +201,8 @@
 
 void MediaControlsRotateToFullscreenDelegateTest::InitScreenAndVideo(
     WebScreenOrientationType initial_screen_orientation,
-    WebSize video_size) {
+    WebSize video_size,
+    bool with_device_orientation /* = true */) {
   // Set initial screen orientation (called by `Attach` during `AppendChild`).
   WebScreenInfo screen_info;
   screen_info.orientation_type = initial_screen_orientation;
@@ -215,6 +219,18 @@
   // Set video size.
   EXPECT_CALL(GetWebMediaPlayer(), NaturalSize())
       .WillRepeatedly(Return(video_size));
+
+  if (with_device_orientation) {
+    // Dispatch an arbitrary Device Orientation event to satisfy
+    // MediaControlsRotateToFullscreenDelegate's requirement that the device
+    // supports the API and can provide beta and gamma values. The orientation
+    // will be ignored.
+    DeviceOrientationController::From(GetDocument())
+        .SetOverride(DeviceOrientationData::Create(
+            0.0 /* alpha */, 90.0 /* beta */, 0.0 /* gamma */,
+            false /* absolute */));
+    testing::RunPendingTasks();
+  }
 }
 
 void MediaControlsRotateToFullscreenDelegateTest::PlayVideo() {
@@ -467,6 +483,33 @@
   EXPECT_FALSE(GetVideo().IsFullscreen());
 }
 
+TEST_F(MediaControlsRotateToFullscreenDelegateTest,
+       EnterFailNoDeviceOrientation) {
+  // Portrait screen, landscape video.
+  InitScreenAndVideo(kWebScreenOrientationPortraitPrimary, WebSize(640, 480),
+                     false /* with_device_orientation */);
+  EXPECT_EQ(SimpleOrientation::kPortrait, ObservedScreenOrientation());
+  EXPECT_EQ(SimpleOrientation::kLandscape, ComputeVideoOrientation());
+
+  // Dispatch an null Device Orientation event, as happens when the device lacks
+  // the necessary hardware to support the Device Orientation API.
+  DeviceOrientationController::From(GetDocument())
+      .SetOverride(DeviceOrientationData::Create());
+  testing::RunPendingTasks();
+
+  // Play video.
+  PlayVideo();
+  UpdateVisibilityObserver();
+
+  EXPECT_TRUE(ObservedVisibility());
+
+  // Rotate screen to landscape.
+  RotateTo(kWebScreenOrientationLandscapePrimary);
+
+  // Should not enter fullscreen since Device Orientation is not available.
+  EXPECT_FALSE(GetVideo().IsFullscreen());
+}
+
 TEST_F(MediaControlsRotateToFullscreenDelegateTest, EnterFailPaused) {
   // Portrait screen, landscape video.
   InitScreenAndVideo(kWebScreenOrientationPortraitPrimary, WebSize(640, 480));

diff --git a/third_party/WebKit/Source/platform/audio/DirectConvolver.cpp b/third_party/WebKit/Source/platform/audio/DirectConvolver.cpp
index f7f9071..9d6f89b 100644
--- a/third_party/WebKit/Source/platform/audio/DirectConvolver.cpp
+++ b/third_party/WebKit/Source/platform/audio/DirectConvolver.cpp

@@ -401,6 +401,7 @@
   }
 #endif
 #endif  // OS_MACOSX
+#undef CONVOLVE_ONE_SAMPLE
 
   // Copy 2nd half of input buffer to 1st half.
   memcpy(buffer_.Data(), input_p, sizeof(float) * frames_to_process);

diff --git a/third_party/WebKit/Source/platform/audio/SincResampler.cpp b/third_party/WebKit/Source/platform/audio/SincResampler.cpp
index 2a2862b..b46acc9a 100644
--- a/third_party/WebKit/Source/platform/audio/SincResampler.cpp
+++ b/third_party/WebKit/Source/platform/audio/SincResampler.cpp

@@ -464,6 +464,7 @@
         }
 #endif
       }
+#undef CONVOLVE_ONE_SAMPLE
 
       // Linearly interpolate the two "convolutions".
       double result = (1.0 - kernel_interpolation_factor) * sum1 +

diff --git a/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.cpp b/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.cpp
index 43bd27ea..90cd83a 100644
--- a/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.cpp
+++ b/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.cpp

@@ -15,7 +15,7 @@
 namespace blink {
 
 namespace {
-// TODO(lunalu): Deprecate the methods in this namesapce when deprecating old
+// TODO(loonybear): Deprecate the methods in this namesapce when deprecating old
 // allow syntax.
 bool IsValidOldAllowSyntax(const String& policy,
                            RefPtr<SecurityOrigin> src_origin) {
@@ -92,9 +92,10 @@
     const String& policy,
     RefPtr<SecurityOrigin> self_origin,
     RefPtr<SecurityOrigin> src_origin,
-    Vector<String>* messages) {
+    Vector<String>* messages,
+    bool* old_syntax) {
   return ParseFeaturePolicy(policy, self_origin, src_origin, messages,
-                            GetDefaultFeatureNameMap());
+                            GetDefaultFeatureNameMap(), old_syntax);
 }
 
 Vector<WebParsedFeaturePolicyDeclaration> ParseFeaturePolicy(
@@ -102,12 +103,16 @@
     RefPtr<SecurityOrigin> self_origin,
     RefPtr<SecurityOrigin> src_origin,
     Vector<String>* messages,
-    const FeatureNameMap& feature_names) {
+    const FeatureNameMap& feature_names,
+    bool* old_syntax) {
   // Temporarily supporting old allow syntax:
   //     allow = "feature1 feature2 feature3 ... "
-  // TODO(lunalu): depracate this old syntax in the future.
-  if (IsValidOldAllowSyntax(policy, src_origin))
+  // TODO(loonybear): depracate this old syntax in the future.
+  if (IsValidOldAllowSyntax(policy, src_origin)) {
+    if (old_syntax)
+      *old_syntax = true;
     return ParseOldAllowSyntax(policy, src_origin, messages, feature_names);
+  }
 
   Vector<WebParsedFeaturePolicyDeclaration> whitelists;
   BitVector features_specified(

diff --git a/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.h b/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.h
index d3358bd0..30c0c7a4 100644
--- a/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.h
+++ b/third_party/WebKit/Source/platform/feature_policy/FeaturePolicy.h

@@ -40,22 +40,34 @@
 // input will cause as warning message to be appended to it.
 // Example of a feature policy string:
 //     "vibrate a.com 'src'; fullscreen 'none'; payment 'self', payment *".
+// If |old_syntax| is not null, it will be set true if the deprecated
+// space-deparated feature list syntax is detected.
+// TODO(loonybear): remove the boolean once the space separated feature list
+// syntax is deprecated.
+// https://crbug.com/761009.
 PLATFORM_EXPORT Vector<WebParsedFeaturePolicyDeclaration>
 ParseFeaturePolicyAttribute(const String& policy,
                             RefPtr<SecurityOrigin> self_origin,
                             RefPtr<SecurityOrigin> src_origin,
-                            Vector<String>* messages);
+                            Vector<String>* messages,
+                            bool* old_syntax);
 
 // Converts a feature policy string into a vector of whitelists (see comments
 // above), with an explicit FeatureNameMap. This algorithm is called by both
 // header policy parsing and container policy parsing. |self_origin| and
 // |src_origin| are both nullable.
+// If |old_syntax| is not null, it will be set true if the deprecated
+// space-deparated feature list syntax is detected.
+// TODO(loonybear): remove the boolean once the space separated feature list
+// syntax is deprecated.
+// https://crbug.com/761009.
 PLATFORM_EXPORT Vector<WebParsedFeaturePolicyDeclaration> ParseFeaturePolicy(
     const String& policy,
     RefPtr<SecurityOrigin> self_origin,
     RefPtr<SecurityOrigin> src_origin,
     Vector<String>* messages,
-    const FeatureNameMap& feature_names);
+    const FeatureNameMap& feature_names,
+    bool* old_syntax = nullptr);
 
 // Verifies whether feature policy is enabled and |feature| is supported in
 // feature policy.

diff --git a/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.cpp b/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.cpp
index 5fc8173..e54714af 100644
--- a/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.cpp
+++ b/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.cpp

@@ -25,7 +25,8 @@
       result_(result),
       break_iterator_(break_iterator),
       spacing_(spacing),
-      hyphenation_(hyphenation) {
+      hyphenation_(hyphenation),
+      is_soft_hyphen_enabled_(true) {
   // ShapeResultSpacing is stateful when it has expansions. We may use it in
   // arbitrary order that it cannot have expansions.
   DCHECK(!spacing_ || !spacing_->HasExpansion());
@@ -88,7 +89,7 @@
 unsigned ShapingLineBreaker::Hyphenate(unsigned offset,
                                        unsigned word_start,
                                        unsigned word_end,
-                                       bool backwards) {
+                                       bool backwards) const {
   DCHECK(hyphenation_);
   DCHECK_GT(word_end, word_start);
   DCHECK_GE(offset, word_start);
@@ -112,7 +113,7 @@
 unsigned ShapingLineBreaker::Hyphenate(unsigned offset,
                                        unsigned start,
                                        bool backwards,
-                                       bool* is_hyphenated) {
+                                       bool* is_hyphenated) const {
   const String& text = GetText();
   unsigned previous_break_opportunity =
       break_iterator_->PreviousBreakOpportunity(offset, start);
@@ -133,20 +134,42 @@
   return word_start + prefix_length;
 }
 
-unsigned ShapingLineBreaker::PreviousBreakOpportunity(unsigned offset,
-                                                      unsigned start,
-                                                      bool* is_hyphenated) {
-  if (!hyphenation_)
-    return break_iterator_->PreviousBreakOpportunity(offset, start);
-  return Hyphenate(offset, start, true, is_hyphenated);
+unsigned ShapingLineBreaker::PreviousBreakOpportunity(
+    unsigned offset,
+    unsigned start,
+    bool* is_hyphenated) const {
+  if (UNLIKELY(!IsSoftHyphenEnabled())) {
+    const String& text = GetText();
+    for (;; offset--) {
+      offset = break_iterator_->PreviousBreakOpportunity(offset, start);
+      if (offset <= start || offset >= text.length() ||
+          text[offset - 1] != kSoftHyphenCharacter)
+        return offset;
+    }
+  }
+
+  if (UNLIKELY(hyphenation_))
+    return Hyphenate(offset, start, true, is_hyphenated);
+
+  return break_iterator_->PreviousBreakOpportunity(offset, start);
 }
 
 unsigned ShapingLineBreaker::NextBreakOpportunity(unsigned offset,
                                                   unsigned start,
-                                                  bool* is_hyphenated) {
-  if (!hyphenation_)
-    return break_iterator_->NextBreakOpportunity(offset);
-  return Hyphenate(offset, start, false, is_hyphenated);
+                                                  bool* is_hyphenated) const {
+  if (UNLIKELY(!IsSoftHyphenEnabled())) {
+    const String& text = GetText();
+    for (;; offset++) {
+      offset = break_iterator_->NextBreakOpportunity(offset);
+      if (offset >= text.length() || text[offset - 1] != kSoftHyphenCharacter)
+        return offset;
+    }
+  }
+
+  if (UNLIKELY(hyphenation_))
+    return Hyphenate(offset, start, false, is_hyphenated);
+
+  return break_iterator_->NextBreakOpportunity(offset);
 }
 
 inline PassRefPtr<ShapeResult> ShapingLineBreaker::Shape(

diff --git a/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.h b/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.h
index 789e0773..1192d06 100644
--- a/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.h
+++ b/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreaker.h

@@ -68,23 +68,27 @@
                                     LayoutUnit available_space,
                                     Result* result_out);
 
+  // Disable breaking at soft hyphens (U+00AD).
+  bool IsSoftHyphenEnabled() const { return is_soft_hyphen_enabled_; }
+  void DisableSoftHyphen() { is_soft_hyphen_enabled_ = false; }
+
  private:
   const String& GetText() const;
 
   unsigned PreviousBreakOpportunity(unsigned offset,
                                     unsigned start,
-                                    bool* is_hyphenated);
+                                    bool* is_hyphenated) const;
   unsigned NextBreakOpportunity(unsigned offset,
                                 unsigned start,
-                                bool* is_hyphenated);
+                                bool* is_hyphenated) const;
   unsigned Hyphenate(unsigned offset,
                      unsigned start,
                      bool backwards,
-                     bool* is_hyphenated);
+                     bool* is_hyphenated) const;
   unsigned Hyphenate(unsigned offset,
                      unsigned word_start,
                      unsigned word_end,
-                     bool backwards);
+                     bool backwards) const;
 
   PassRefPtr<ShapeResult> Shape(TextDirection, unsigned start, unsigned end);
   PassRefPtr<ShapeResult> ShapeToEnd(unsigned start,
@@ -99,6 +103,9 @@
   // has expansions. Split spacing and expansions to make this const.
   ShapeResultSpacing<String>* spacing_;
   const Hyphenation* hyphenation_;
+  bool is_soft_hyphen_enabled_;
+
+  friend class ShapingLineBreakerTest;
 };
 
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreakerTest.cpp b/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreakerTest.cpp
index 051d4c4..8674f80b 100644
--- a/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreakerTest.cpp
+++ b/third_party/WebKit/Source/platform/fonts/shaping/ShapingLineBreakerTest.cpp

@@ -13,6 +13,7 @@
 #include "platform/text/TextBreakIterator.h"
 #include "platform/text/TextRun.h"
 #include "platform/wtf/Vector.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
@@ -42,6 +43,35 @@
 
   void TearDown() override {}
 
+  // Compute all break positions by |NextBreakOpportunity|.
+  Vector<unsigned> BreakPositionsByNext(const ShapingLineBreaker& breaker,
+                                        const String& string) {
+    Vector<unsigned> break_positions;
+    for (unsigned i = 0; i <= string.length(); i++) {
+      bool is_hyphenated = false;
+      unsigned next = breaker.NextBreakOpportunity(i, 0, &is_hyphenated);
+      if (break_positions.IsEmpty() || break_positions.back() != next)
+        break_positions.push_back(next);
+    }
+    return break_positions;
+  }
+
+  // Compute all break positions by |PreviousBreakOpportunity|.
+  Vector<unsigned> BreakPositionsByPrevious(const ShapingLineBreaker& breaker,
+                                            const String& string) {
+    Vector<unsigned> break_positions;
+    for (unsigned i = string.length(); i; i--) {
+      bool is_hyphenated = false;
+      unsigned previous =
+          breaker.PreviousBreakOpportunity(i, 0, &is_hyphenated);
+      if (previous &&
+          (break_positions.IsEmpty() || break_positions.back() != previous))
+        break_positions.push_back(previous);
+    }
+    break_positions.Reverse();
+    return break_positions;
+  }
+
   FontCachePurgePreventer font_cache_purge_preventer;
   FontDescription font_description;
   Font font;
@@ -257,4 +287,56 @@
   EXPECT_EQ(2u, break_offset);
   EXPECT_EQ(result->Width(), line->Width());
 }
+
+struct BreakOpportunityTestData {
+  const char16_t* string;
+  Vector<unsigned> break_positions;
+  Vector<unsigned> break_positions_with_soft_hyphen_disabled;
+};
+
+class BreakOpportunityTest
+    : public ShapingLineBreakerTest,
+      public ::testing::WithParamInterface<BreakOpportunityTestData> {};
+
+INSTANTIATE_TEST_CASE_P(
+    ShapingLineBreakerTest,
+    BreakOpportunityTest,
+    ::testing::Values(BreakOpportunityTestData{u"x y z", {1, 3, 5}},
+                      BreakOpportunityTestData{u"y\xADz", {2, 3}, {3}},
+                      BreakOpportunityTestData{u"\xADz", {1, 2}, {2}},
+                      BreakOpportunityTestData{u"y\xAD", {2}, {2}},
+                      BreakOpportunityTestData{u"\xAD\xADz", {2, 3}, {3}}));
+
+TEST_P(BreakOpportunityTest, Next) {
+  const BreakOpportunityTestData& data = GetParam();
+  String string(data.string);
+  LazyLineBreakIterator break_iterator(string);
+  ShapingLineBreaker breaker(nullptr, &font, nullptr, &break_iterator);
+  EXPECT_THAT(BreakPositionsByNext(breaker, string),
+              ::testing::ElementsAreArray(data.break_positions));
+
+  if (!data.break_positions_with_soft_hyphen_disabled.IsEmpty()) {
+    breaker.DisableSoftHyphen();
+    EXPECT_THAT(BreakPositionsByNext(breaker, string),
+                ::testing::ElementsAreArray(
+                    data.break_positions_with_soft_hyphen_disabled));
+  }
+}
+
+TEST_P(BreakOpportunityTest, Previous) {
+  const BreakOpportunityTestData& data = GetParam();
+  String string(data.string);
+  LazyLineBreakIterator break_iterator(string);
+  ShapingLineBreaker breaker(nullptr, &font, nullptr, &break_iterator);
+  EXPECT_THAT(BreakPositionsByPrevious(breaker, string),
+              ::testing::ElementsAreArray(data.break_positions));
+
+  if (!data.break_positions_with_soft_hyphen_disabled.IsEmpty()) {
+    breaker.DisableSoftHyphen();
+    EXPECT_THAT(BreakPositionsByPrevious(breaker, string),
+                ::testing::ElementsAreArray(
+                    data.break_positions_with_soft_hyphen_disabled));
+  }
+}
+
 }  // namespace blink

diff --git a/third_party/WebKit/Source/platform/graphics/VideoFrameResourceProvider.h b/third_party/WebKit/Source/platform/graphics/VideoFrameResourceProvider.h
index 3f8dd96..f2210ca 100644
--- a/third_party/WebKit/Source/platform/graphics/VideoFrameResourceProvider.h
+++ b/third_party/WebKit/Source/platform/graphics/VideoFrameResourceProvider.h

@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#ifndef VideoFrameResourceProvider_h
+#define VideoFrameResourceProvider_h
+
 namespace cc {
 class RenderPass;
 }
@@ -19,3 +22,5 @@
 };
 
 }  // namespace blink
+
+#endif  // VideoFrameResourceProvider_h

diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl.cc b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl.cc
index 8439ef3..30fc2f5 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/renderer_scheduler_impl.cc

@@ -1165,6 +1165,11 @@
     new_policy.timer_queue_policy().is_paused = true;
   }
 
+  if (main_thread_only().renderer_backgrounded &&
+      RuntimeEnabledFeatures::TimerThrottlingForBackgroundTabsEnabled()) {
+    new_policy.timer_queue_policy().is_throttled = true;
+  }
+
   if (main_thread_only().use_virtual_time) {
     new_policy.compositor_queue_policy().use_virtual_time = true;
     new_policy.default_queue_policy().use_virtual_time = true;

diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl.cc b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl.cc
index 3513a83..02a6743 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl.cc

@@ -295,6 +295,11 @@
       break;
 
     case VirtualTimePolicy::DETERMINISTIC_LOADING:
+      // If we're using VirtualTimePolicy::DETERMINISTIC_LOADING it's because
+      // we're expecting a network fetch. We reset |have_seen_loading_task_| to
+      // avoid a race between the load starting and virtual time budget
+      // expiring.
+      have_seen_loading_task_ = false;
       ApplyVirtualTimePolicyForLoading();
       break;
   }

diff --git a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
index e16411b8..5daa146b 100644
--- a/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc
+++ b/third_party/WebKit/Source/platform/scheduler/renderer/web_view_scheduler_impl_unittest.cc

@@ -509,6 +509,18 @@
 
   web_view_scheduler_->DidStopLoading(4u);
   EXPECT_TRUE(web_view_scheduler_->VirtualTimeAllowedToAdvance());
+
+  // If we set the policy again, virtual time is not allowed to advance until we
+  // have seen at least one subsequent load.
+  web_view_scheduler_->SetVirtualTimePolicy(
+      VirtualTimePolicy::DETERMINISTIC_LOADING);
+  EXPECT_FALSE(web_view_scheduler_->VirtualTimeAllowedToAdvance());
+
+  web_view_scheduler_->DidStartLoading(5u);
+  EXPECT_FALSE(web_view_scheduler_->VirtualTimeAllowedToAdvance());
+
+  web_view_scheduler_->DidStopLoading(5u);
+  EXPECT_TRUE(web_view_scheduler_->VirtualTimeAllowedToAdvance());
 }
 
 TEST_F(WebViewSchedulerImplTest, RedundantDidStopLoadingCallsAreHarmless) {

diff --git a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
index 94bb9161..0671c471 100644
--- a/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h
+++ b/third_party/WebKit/Source/platform/wtf/typed_arrays/ArrayBufferContents.h

@@ -122,7 +122,9 @@
     void* Data() const { return data_; }
     size_t DataLength() const { return data_length_; }
 
-    ArrayBufferContents::AllocationKind AllocationKind() const { return kind_; }
+    ArrayBufferContents::AllocationKind GetAllocationKind() const {
+      return kind_;
+    }
 
     operator bool() const { return allocation_base_; }
 

diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py
index 2211ad08..b87eabb 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl.py

@@ -67,28 +67,52 @@
         return self.run(['issue']).split()[2]
 
     def wait_for_try_jobs(self, poll_delay_seconds=10 * 60, timeout_seconds=120 * 60):
-        """Waits until all try jobs are finished.
-
-        Args:
-            poll_delay_seconds: Time to wait between fetching results.
-            timeout_seconds: Time to wait before aborting.
+        """Waits until all try jobs are finished and returns results, or None.
 
         Returns:
             A dict mapping Build objects to TryJobStatus objects, or
             None if a timeout occurred.
         """
-        start = self._host.time()
-        self._host.print_('Waiting for try jobs (timeout: %d seconds).' % timeout_seconds)
-        while self._host.time() - start < timeout_seconds:
-            self._host.sleep(poll_delay_seconds)
-            try_results = self.try_job_results()
-            _log.debug('Fetched try results: %s', try_results)
-            if try_results and self.all_finished(try_results):
+
+        def finished_try_job_results_or_none():
+            results = self.try_job_results()
+            _log.debug('Fetched try results: %s', results)
+            if results and self.all_finished(results):
                 self._host.print_('All jobs finished.')
-                return try_results
-            self._host.print_('Waiting. %d seconds passed.' % (self._host.time() - start))
+                return results
+            return None
+
+        return self._wait_for(
+            finished_try_job_results_or_none,
+            poll_delay_seconds, timeout_seconds,
+            message=' for try jobs')
+
+    def _wait_for(self, poll_function, poll_delay_seconds, timeout_seconds, message=''):
+        """Waits for the given poll_function to return something other than None.
+
+        Args:
+            poll_function: A function with no args that returns something
+                when ready, or None when not ready.
+            poll_delay_seconds: Time to wait between fetching results.
+            timeout_seconds: Time to wait before aborting.
+            message: Message to print indicate what is being waited for.
+
+        Returns:
+            The value returned by poll_function, or None on timeout.
+        """
+        start = self._host.time()
+        self._host.print_(
+            'Waiting%s, timeout: %d seconds.' % (message, timeout_seconds))
+        while (self._host.time() - start) < timeout_seconds:
             self._host.sleep(poll_delay_seconds)
-        self._host.print_('Timed out waiting for try results.')
+            value = poll_function()
+            if value is not None:
+                return value
+            self._host.print_(
+                'Waiting%s. %d seconds passed.' %
+                (message, self._host.time() - start))
+            self._host.sleep(poll_delay_seconds)
+        self._host.print_('Timed out waiting%s.' % message)
         return None
 
     def latest_try_jobs(self, builder_names=None):

diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_mock.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_mock.py
index 5361c6e..7f499b6a1 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_mock.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_mock.py

@@ -10,7 +10,7 @@
 
     def __init__(self, host, results=None, issue_number='1234'):
         self._host = host
-        self._results = results or {}
+        self._results = results
         self._issue_number = issue_number
         self.calls = []
 

diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py
index 2343bf794..7d639db3 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/common/net/git_cl_unittest.py

@@ -63,14 +63,14 @@
         git_cl.wait_for_try_jobs()
         self.assertEqual(
             host.stdout.getvalue(),
-            'Waiting for try jobs (timeout: 7200 seconds).\n'
-            'Waiting. 600 seconds passed.\n'
-            'Waiting. 1800 seconds passed.\n'
-            'Waiting. 3000 seconds passed.\n'
-            'Waiting. 4200 seconds passed.\n'
-            'Waiting. 5400 seconds passed.\n'
-            'Waiting. 6600 seconds passed.\n'
-            'Timed out waiting for try results.\n')
+            'Waiting for try jobs, timeout: 7200 seconds.\n'
+            'Waiting for try jobs. 600 seconds passed.\n'
+            'Waiting for try jobs. 1800 seconds passed.\n'
+            'Waiting for try jobs. 3000 seconds passed.\n'
+            'Waiting for try jobs. 4200 seconds passed.\n'
+            'Waiting for try jobs. 5400 seconds passed.\n'
+            'Waiting for try jobs. 6600 seconds passed.\n'
+            'Timed out waiting for try jobs.\n')
 
     def test_wait_for_try_jobs_no_results_not_considered_finished(self):
         host = MockHost()
@@ -79,14 +79,14 @@
         git_cl.wait_for_try_jobs()
         self.assertEqual(
             host.stdout.getvalue(),
-            'Waiting for try jobs (timeout: 7200 seconds).\n'
-            'Waiting. 600 seconds passed.\n'
-            'Waiting. 1800 seconds passed.\n'
-            'Waiting. 3000 seconds passed.\n'
-            'Waiting. 4200 seconds passed.\n'
-            'Waiting. 5400 seconds passed.\n'
-            'Waiting. 6600 seconds passed.\n'
-            'Timed out waiting for try results.\n')
+            'Waiting for try jobs, timeout: 7200 seconds.\n'
+            'Waiting for try jobs. 600 seconds passed.\n'
+            'Waiting for try jobs. 1800 seconds passed.\n'
+            'Waiting for try jobs. 3000 seconds passed.\n'
+            'Waiting for try jobs. 4200 seconds passed.\n'
+            'Waiting for try jobs. 5400 seconds passed.\n'
+            'Waiting for try jobs. 6600 seconds passed.\n'
+            'Timed out waiting for try jobs.\n')
 
     def test_wait_for_try_jobs_done(self):
         host = MockHost()
@@ -102,7 +102,7 @@
         git_cl.wait_for_try_jobs()
         self.assertEqual(
             host.stdout.getvalue(),
-            'Waiting for try jobs (timeout: 7200 seconds).\n'
+            'Waiting for try jobs, timeout: 7200 seconds.\n'
             'All jobs finished.\n')
 
     def test_has_failing_try_results_empty(self):

diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py
index caaede5..d49c74e 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer.py

@@ -172,6 +172,12 @@
         try_results = self.git_cl.wait_for_try_jobs(
             poll_delay_seconds=POLL_DELAY_SECONDS,
             timeout_seconds=TIMEOUT_SECONDS)
+
+        if not try_results:
+            self.git_cl.run(['set-close'])
+            _log.error('Timed out waiting for CQ; aborting.')
+            return False
+
         try_results = self.git_cl.filter_latest(try_results)
 
         # We only want to check the status of CQ bots. The set of CQ bots is
@@ -180,15 +186,15 @@
         # Blink try bots to get the set of CQ try bots.
         # Important: if any CQ bots are added to the builder list
         # (self.host.builders), then this logic will need to be updated.
-        try_results = {build: status for build, status in try_results.items()
-                       if build.builder_name not in self.blink_try_bots()}
+        cq_try_results = {build: status for build, status in try_results.items()
+                          if build.builder_name not in self.blink_try_bots()}
 
-        if not try_results:
+        if not cq_try_results:
+            _log.error('No CQ try results found in try results: %s.', try_results)
             self.git_cl.run(['set-close'])
-            _log.error('No CQ try job results, aborting.')
             return False
 
-        if try_results and self.git_cl.all_success(try_results):
+        if self.git_cl.all_success(cq_try_results):
             _log.info('CQ appears to have passed; trying to commit.')
             self.git_cl.run(['upload', '-f', '--send-mail'])  # Turn off WIP mode.
             self.git_cl.run(['set-commit'])

diff --git a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer_unittest.py b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer_unittest.py
index da15e50..73f8781c 100644
--- a/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer_unittest.py
+++ b/third_party/WebKit/Tools/Scripts/webkitpy/w3c/test_importer_unittest.py

@@ -136,6 +136,22 @@
             ['git', 'cl', 'set-commit'],
         ])
 
+    def test_run_commit_queue_for_cl_timeout(self):
+        host = MockHost()
+        importer = TestImporter(host)
+        # The simulates the case where importer.git_cl.wait_for_try_jobs returns
+        # None, which would normally happen if we time out waiting for results.
+        importer.git_cl = MockGitCL(host, results=None)
+        success = importer.run_commit_queue_for_cl()
+        self.assertFalse(success)
+        self.assertLog([
+            'INFO: Triggering CQ try jobs.\n',
+            'ERROR: Timed out waiting for CQ; aborting.\n'
+        ])
+        self.assertEqual(
+            importer.git_cl.calls,
+            [['git', 'cl', 'try'], ['git', 'cl', 'set-close']])
+
     def test_apply_exportable_commits_locally(self):
         host = MockHost()
         importer = TestImporter(host, wpt_github=MockWPTGitHub(pull_requests=[]))

diff --git a/third_party/WebKit/public/platform/web_feature.mojom b/third_party/WebKit/public/platform/web_feature.mojom
index 56258478..25b6f14a 100644
--- a/third_party/WebKit/public/platform/web_feature.mojom
+++ b/third_party/WebKit/public/platform/web_feature.mojom

@@ -1677,6 +1677,7 @@
   kWebkitBoxLineClampOneChildIsLayoutBlockFlowInline = 2142,
   kWebkitBoxLineClampManyChildren = 2143,
   kWebkitBoxLineClampDoesSomething = 2144,
+  kFeaturePolicyAllowAttributeDeprecatedSyntax = 2145,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.

diff --git a/third_party/WebKit/public/web/WebAXObject.h b/third_party/WebKit/public/web/WebAXObject.h
index b796e87..b139f443 100644
--- a/third_party/WebKit/public/web/WebAXObject.h
+++ b/third_party/WebKit/public/web/WebAXObject.h

@@ -153,10 +153,6 @@
 
   BLINK_EXPORT WebString AccessKey() const;
   BLINK_EXPORT unsigned BackgroundColor() const;
-  BLINK_EXPORT bool CanPress() const;
-  BLINK_EXPORT bool CanSetValueAttribute() const;
-  BLINK_EXPORT bool CanSetFocusAttribute() const;
-  BLINK_EXPORT bool CanSetSelectedAttribute() const;
   BLINK_EXPORT unsigned GetColor() const;
   // Deprecated.
   BLINK_EXPORT void ColorValue(int& r, int& g, int& b) const;
@@ -222,6 +218,10 @@
                               WebAXObject& focus_object,
                               int& focus_offset,
                               WebAXTextAffinity& focus_affinity) const;
+  BLINK_EXPORT void SetSelection(const WebAXObject& anchor_object,
+                                 int anchor_offset,
+                                 const WebAXObject& focus_object,
+                                 int focus_offset) const;
 
   // The following selection functions return text offsets calculated starting
   // the current object. They only report on a selection that is placed on
@@ -262,29 +262,24 @@
                             WebVector<int>& starts,
                             WebVector<int>& ends) const;
 
-  // Actions. Return true if handled.
+  // Actions
   BLINK_EXPORT WebAXDefaultActionVerb Action() const;
-  BLINK_EXPORT bool Click() const;
-  BLINK_EXPORT bool Decrement() const;
+  BLINK_EXPORT bool CanDecrement() const;
+  BLINK_EXPORT bool CanIncrement() const;
+  BLINK_EXPORT bool CanPress() const;
+  BLINK_EXPORT bool CanSetValueAttribute() const;
+  BLINK_EXPORT bool CanSetFocusAttribute() const;
+  BLINK_EXPORT bool CanSetSelectedAttribute() const;
+  BLINK_EXPORT bool PerformDefaultAction() const;
+  BLINK_EXPORT bool Press() const;
   BLINK_EXPORT bool Increment() const;
-  BLINK_EXPORT bool Focus() const;
-  BLINK_EXPORT bool SetSelected(bool) const;
-  BLINK_EXPORT bool SetSelection(const WebAXObject& anchor_object,
-                                 int anchor_offset,
-                                 const WebAXObject& focus_object,
-                                 int focus_offset) const;
-  BLINK_EXPORT bool SetSequentialFocusNavigationStartingPoint() const;
-  BLINK_EXPORT bool SetValue(WebString) const;
-  BLINK_EXPORT bool ShowContextMenu() const;
-  // Make this object visible by scrolling as many nested scrollable views as
-  // needed.
-  BLINK_EXPORT bool ScrollToMakeVisible() const;
-  // Same, but if the whole object can't be made visible, try for this subrect,
-  // in local coordinates.
-  BLINK_EXPORT bool ScrollToMakeVisibleWithSubFocus(const WebRect&) const;
-  // Scroll this object to a given point in global coordinates of the top-level
-  // window.
-  BLINK_EXPORT bool ScrollToGlobalPoint(const WebPoint&) const;
+  BLINK_EXPORT bool Decrement() const;
+  BLINK_EXPORT void SetFocused(bool) const;
+  BLINK_EXPORT void SetSelectedTextRange(int selection_start,
+                                         int selection_end) const;
+  BLINK_EXPORT void SetSequentialFocusNavigationStartingPoint() const;
+  BLINK_EXPORT void SetValue(WebString) const;
+  BLINK_EXPORT void ShowContextMenu() const;
 
   // For a table
   BLINK_EXPORT int AriaColumnCount() const;
@@ -349,6 +344,16 @@
                                       WebFloatRect& bounds_in_container,
                                       SkMatrix44& container_transform) const;
 
+  // Make this object visible by scrolling as many nested scrollable views as
+  // needed.
+  BLINK_EXPORT void ScrollToMakeVisible() const;
+  // Same, but if the whole object can't be made visible, try for this subrect,
+  // in local coordinates.
+  BLINK_EXPORT void ScrollToMakeVisibleWithSubFocus(const WebRect&) const;
+  // Scroll this object to a given point in global coordinates of the top-level
+  // window.
+  BLINK_EXPORT void ScrollToGlobalPoint(const WebPoint&) const;
+
 #if INSIDE_BLINK
   BLINK_EXPORT WebAXObject(AXObject*);
   WebAXObject& operator=(AXObject*);

diff --git a/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-client-protocol.h b/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-client-protocol.h
index 30bc9017..df883d0d 100644
--- a/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-client-protocol.h
+++ b/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-client-protocol.h

@@ -293,6 +293,16 @@
 	void (*configure)(void *data,
 			  struct zcr_remote_shell_v1 *zcr_remote_shell_v1,
 			  uint32_t layout_mode);
+	/**
+	 * initialize scale configuration
+	 *
+	 * Sends the default device scale factor.
+	 * @param scale DP to pixels ratio, in 16.16 fixed point format
+	 * @since 8
+	 */
+	void (*default_device_scale_factor)(void *data,
+					    struct zcr_remote_shell_v1 *zcr_remote_shell_v1,
+					    int32_t scale);
 };
 
 /**
@@ -326,6 +336,10 @@
  * @ingroup iface_zcr_remote_shell_v1
  */
 #define ZCR_REMOTE_SHELL_V1_CONFIGURE_SINCE_VERSION 5
+/**
+ * @ingroup iface_zcr_remote_shell_v1
+ */
+#define ZCR_REMOTE_SHELL_V1_DEFAULT_DEVICE_SCALE_FACTOR_SINCE_VERSION 8
 
 /**
  * @ingroup iface_zcr_remote_shell_v1
@@ -471,14 +485,14 @@
  * The type of the window.
  */
 enum zcr_remote_surface_v1_window_type {
-  /**
-   * normal app window
-   */
-  ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_NORMAL = 1,
-  /**
-   * window is treated as systemui
-   */
-  ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_SYSTEM_UI = 2,
+	/**
+	 * normal app window
+	 */
+	ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_NORMAL = 1,
+	/**
+	 * window is treated as systemui
+	 */
+	ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_SYSTEM_UI = 2,
 };
 #endif /* ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_ENUM */
 
@@ -1144,11 +1158,11 @@
  * Set the type of window. This is only a hint to the compositor and the
  * compositor is free to ignore it.
  */
-static inline void zcr_remote_surface_v1_set_window_type(
-    struct zcr_remote_surface_v1* zcr_remote_surface_v1,
-    uint32_t type) {
-  wl_proxy_marshal((struct wl_proxy*)zcr_remote_surface_v1,
-                   ZCR_REMOTE_SURFACE_V1_SET_WINDOW_TYPE, type);
+static inline void
+zcr_remote_surface_v1_set_window_type(struct zcr_remote_surface_v1 *zcr_remote_surface_v1, uint32_t type)
+{
+	wl_proxy_marshal((struct wl_proxy *) zcr_remote_surface_v1,
+			 ZCR_REMOTE_SURFACE_V1_SET_WINDOW_TYPE, type);
 }
 
 #define ZCR_NOTIFICATION_SURFACE_V1_DESTROY 0

diff --git a/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-server-protocol.h b/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-server-protocol.h
index eff65db..08b09e5 100644
--- a/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-server-protocol.h
+++ b/third_party/wayland-protocols/include/protocol/remote-shell-unstable-v1-server-protocol.h

@@ -283,6 +283,7 @@
 #define ZCR_REMOTE_SHELL_V1_CONFIGURATION_CHANGED 1
 #define ZCR_REMOTE_SHELL_V1_WORKSPACE 2
 #define ZCR_REMOTE_SHELL_V1_CONFIGURE 3
+#define ZCR_REMOTE_SHELL_V1_DEFAULT_DEVICE_SCALE_FACTOR 4
 
 /**
  * @ingroup iface_zcr_remote_shell_v1
@@ -300,6 +301,10 @@
  * @ingroup iface_zcr_remote_shell_v1
  */
 #define ZCR_REMOTE_SHELL_V1_CONFIGURE_SINCE_VERSION 5
+/**
+ * @ingroup iface_zcr_remote_shell_v1
+ */
+#define ZCR_REMOTE_SHELL_V1_DEFAULT_DEVICE_SCALE_FACTOR_SINCE_VERSION 8
 
 /**
  * @ingroup iface_zcr_remote_shell_v1
@@ -359,6 +364,18 @@
 	wl_resource_post_event(resource_, ZCR_REMOTE_SHELL_V1_CONFIGURE, layout_mode);
 }
 
+/**
+ * @ingroup iface_zcr_remote_shell_v1
+ * Sends an default_device_scale_factor event to the client owning the resource.
+ * @param resource_ The client's resource
+ * @param scale DP to pixels ratio, in 16.16 fixed point format
+ */
+static inline void
+zcr_remote_shell_v1_send_default_device_scale_factor(struct wl_resource *resource_, int32_t scale)
+{
+	wl_resource_post_event(resource_, ZCR_REMOTE_SHELL_V1_DEFAULT_DEVICE_SCALE_FACTOR, scale);
+}
+
 #ifndef ZCR_REMOTE_SURFACE_V1_SYSTEMUI_VISIBILITY_STATE_ENUM
 #define ZCR_REMOTE_SURFACE_V1_SYSTEMUI_VISIBILITY_STATE_ENUM
 /**
@@ -412,14 +429,14 @@
  * The type of the window.
  */
 enum zcr_remote_surface_v1_window_type {
-  /**
-   * normal app window
-   */
-  ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_NORMAL = 1,
-  /**
-   * window is treated as systemui
-   */
-  ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_SYSTEM_UI = 2,
+	/**
+	 * normal app window
+	 */
+	ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_NORMAL = 1,
+	/**
+	 * window is treated as systemui
+	 */
+	ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_SYSTEM_UI = 2,
 };
 #endif /* ZCR_REMOTE_SURFACE_V1_WINDOW_TYPE_ENUM */
 
@@ -761,17 +778,17 @@
 	void (*set_orientation)(struct wl_client *client,
 				struct wl_resource *resource,
 				int32_t orientation);
-        /**
-         * set the type of the window
-         *
-         * Set the type of window. This is only a hint to the compositor
-         * and the compositor is free to ignore it.
-         * @param type type of the window
-         * @since 7
-         */
-        void (*set_window_type)(struct wl_client* client,
-                                struct wl_resource* resource,
-                                uint32_t type);
+	/**
+	 * set the type of the window
+	 *
+	 * Set the type of window. This is only a hint to the compositor
+	 * and the compositor is free to ignore it.
+	 * @param type type of the window
+	 * @since 7
+	 */
+	void (*set_window_type)(struct wl_client *client,
+				struct wl_resource *resource,
+				uint32_t type);
 };
 
 #define ZCR_REMOTE_SURFACE_V1_CLOSE 0

diff --git a/third_party/wayland-protocols/protocol/remote-shell-protocol.c b/third_party/wayland-protocols/protocol/remote-shell-protocol.c
index bd8c6446..2cefcaff 100644
--- a/third_party/wayland-protocols/protocol/remote-shell-protocol.c
+++ b/third_party/wayland-protocols/protocol/remote-shell-protocol.c

@@ -66,12 +66,13 @@
 	{ "configuration_changed", "iiifiiiiu", types + 0 },
 	{ "workspace", "5uuiiiiiiiiifu", types + 0 },
 	{ "configure", "5u", types + 0 },
+	{ "default_device_scale_factor", "8i", types + 0 },
 };
 
 WL_EXPORT const struct wl_interface zcr_remote_shell_v1_interface = {
-	"zcr_remote_shell_v1", 7,
+	"zcr_remote_shell_v1", 8,
 	3, zcr_remote_shell_v1_requests,
-	4, zcr_remote_shell_v1_events,
+	5, zcr_remote_shell_v1_events,
 };
 
 static const struct wl_message zcr_remote_surface_v1_requests[] = {

diff --git a/third_party/wayland-protocols/unstable/remote-shell/remote-shell-unstable-v1.xml b/third_party/wayland-protocols/unstable/remote-shell/remote-shell-unstable-v1.xml
index 738eb73..3fa25840 100644
--- a/third_party/wayland-protocols/unstable/remote-shell/remote-shell-unstable-v1.xml
+++ b/third_party/wayland-protocols/unstable/remote-shell/remote-shell-unstable-v1.xml

@@ -38,7 +38,7 @@
     reset.
   </description>
 
-  <interface name="zcr_remote_shell_v1" version="7">
+  <interface name="zcr_remote_shell_v1" version="8">
     <description summary="remote_shell">
       The global interface that allows clients to turn a wl_surface into a
       "real window" which is remotely managed but can be stacked, activated
@@ -169,6 +169,15 @@
       </description>
       <arg name="layout_mode" type="uint"/>
     </event>
+
+    <!-- Version 8 additions -->
+
+    <event name="default_device_scale_factor" since="8">
+      <description summary="initialize scale configuration">
+	Sends the default device scale factor.
+      </description>
+      <arg name="scale" type="int" summary="DP to pixels ratio, in 16.16 fixed point format"/>
+    </event>
   </interface>
 
   <interface name="zcr_remote_surface_v1" version="7">

diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode.dlldata.c b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode.dlldata.c
new file mode 100644
index 0000000..cc01b78
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode.dlldata.c

@@ -0,0 +1,37 @@
+/*********************************************************

+   DllData file -- generated by MIDL compiler 

+

+        DO NOT ALTER THIS FILE

+

+   This file is regenerated by MIDL on every IDL file compile.

+

+   To completely reconstruct this file, delete it and rerun MIDL

+   on all the IDL files in this DLL, specifying this file for the

+   /dlldata command line option

+

+*********************************************************/

+

+

+#include <rpcproxy.h>

+

+#ifdef __cplusplus

+extern "C"   {

+#endif

+

+EXTERN_PROXY_FILE( ISimpleDOMNode )

+

+

+PROXYFILE_LIST_START

+/* Start of list */

+  REFERENCE_PROXY_FILE( ISimpleDOMNode ),

+/* End of list */

+PROXYFILE_LIST_END

+

+

+DLLDATA_ROUTINES( aProxyFileList, GET_DLL_CLSID )

+

+#ifdef __cplusplus

+}  /*extern "C" */

+#endif

+

+/* end of generated dlldata file */


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode.h b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode.h
new file mode 100644
index 0000000..eef4e9e7
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode.h

@@ -0,0 +1,477 @@
+

+

+/* this ALWAYS GENERATED file contains the definitions for the interfaces */

+

+

+ /* File created by MIDL compiler version 8.01.0622 */

+/* at Mon Jan 18 22:14:07 2038

+ */

+/* Compiler settings for ../../third_party/isimpledom/ISimpleDOMNode.idl:

+    Oicf, W1, Zp8, env=Win32 (32b run), target_arch=X86 8.01.0622 

+    protocol : dce , ms_ext, c_ext, robust

+    error checks: allocation ref bounds_check enum stub_data 

+    VC __declspec() decoration level: 

+         __declspec(uuid()), __declspec(selectany), __declspec(novtable)

+         DECLSPEC_UUID(), MIDL_INTERFACE()

+*/

+/* @@MIDL_FILE_HEADING(  ) */

+

+#pragma warning( disable: 4049 )  /* more than 64k source lines */

+

+

+/* verify that the <rpcndr.h> version is high enough to compile this file*/

+#ifndef __REQUIRED_RPCNDR_H_VERSION__

+#define __REQUIRED_RPCNDR_H_VERSION__ 475

+#endif

+

+#include "rpc.h"

+#include "rpcndr.h"

+

+#ifndef __RPCNDR_H_VERSION__

+#error this stub requires an updated version of <rpcndr.h>

+#endif /* __RPCNDR_H_VERSION__ */

+

+#ifndef COM_NO_WINDOWS_H

+#include "windows.h"

+#include "ole2.h"

+#endif /*COM_NO_WINDOWS_H*/

+

+#ifndef __ISimpleDOMNode_h__

+#define __ISimpleDOMNode_h__

+

+#if defined(_MSC_VER) && (_MSC_VER >= 1020)

+#pragma once

+#endif

+

+/* Forward Declarations */ 

+

+#ifndef __ISimpleDOMNode_FWD_DEFINED__

+#define __ISimpleDOMNode_FWD_DEFINED__

+typedef interface ISimpleDOMNode ISimpleDOMNode;

+

+#endif 	/* __ISimpleDOMNode_FWD_DEFINED__ */

+

+

+/* header files for imported files */

+#include "objidl.h"

+#include "oaidl.h"

+

+#ifdef __cplusplus

+extern "C"{

+#endif 

+

+

+/* interface __MIDL_itf_ISimpleDOMNode_0000_0000 */

+/* [local] */ 

+

+///////////////////////////////////////////////////////////////////////////////////////////////////////

+//

+// ISimpleDOMNode

+// ---------------------------------------------------------------------------------------------------=

+// An interface that extends MSAA's IAccessible to provide readonly DOM node information via cross-process COM.

+//

+// @STATUS UNDER_REVIEW

+//

+// get_nodeInfo(

+//  /* [out] */ BSTR  *nodeName,   // For elements, this is the tag name

+//  /* [out] */ short  *nameSpaceID,

+//  /* [out] */ BSTR  *nodeValue, 

+//  /* [out] */ unsigned int    *numChildren); 

+//  /* [out] */ unsigned int    *uniqueID;  // In Win32 accessible events we generate, the target's childID matches to this

+//  /* [out] */ unsigned short  *nodeType,

+// ---------------------------------------------------------------------------------------------------=

+// Get the basic information about a node.

+// The namespace ID can be mapped to an URI using nsISimpleDOMDocument::get_nameSpaceURIForID()

+//

+// get_attributes(

+//  /* [in]  */ unsigned short maxAttribs,

+//  /* [out] */ unsigned short  *numAttribs,

+//  /* [out] */ BSTR  *attribNames,

+//  /* [out] */ short *nameSpaceID,

+//  /* [out] */ BSTR  *attribValues);

+// ---------------------------------------------------------------------------------------------------=

+// Returns 3 arrays - the attribute names and values, and a namespace ID for each

+// If the namespace ID is 0, it's the same namespace as the node's namespace

+//

+// get_attributesForNames(

+//  /* [in] */ unsigned short numAttribs,

+//  /* [in] */ BSTR   *attribNames,

+//  /* [in] */ short  *nameSpaceID,

+//  /* [out] */ BSTR  *attribValues);

+// ---------------------------------------------------------------------------------------------------=

+// Takes 2 arrays - the attribute names and namespace IDs, and returns an array of corresponding values

+// If the namespace ID is 0, it's the same namespace as the node's namespace

+//

+// computedStyle(  

+//  /* [in]  */ unsigned short maxStyleProperties,

+//  /* [out] */ unsigned short *numStyleProperties, 

+//  /* [in]  */ boolean useAlternateView,  // If TRUE, returns properites for media as set in nsIDOMDocument::set_alternateViewMediaTypes

+//  /* [out] */ BSTR *styleProperties, 

+//  /* [out] */ BSTR *styleValues);

+// ---------------------------------------------------------------------------------------------------=

+// Returns 2 arrays -- the style properties and their values

+//  useAlternateView=FALSE: gets properties for the default media type (usually screen)

+//  useAlternateView=TRUE: properties for media types set w/ nsIDOMSimpleDocument::set_alternateViewMediaTypes()

+//

+// computedStyleForProperties(  

+//  /* [in] */  unsigned short numStyleProperties, 

+//  /* [in] */  boolean useAlternateView,  // If TRUE, returns properites for media as set in nsIDOMDocument::set_alternateViewMediaTypes

+//  /* [in] */  BSTR *styleProperties, 

+//  /* [out] */ BSTR *styleValues);

+// ---------------------------------------------------------------------------------------------------=

+// Scroll the current view so that this dom node is visible.

+//  placeTopLeft=TRUE: scroll until the top left corner of the dom node is at the top left corner of the view.

+//  placeTopLeft=FALSE: scroll minimally to make the dom node visible. Don't scroll at all if already visible.

+//

+// scrollTo( 

+//  /* [in] */ boolean placeTopLeft); 

+// ---------------------------------------------------------------------------------------------------=

+// Returns style property values for those properties in the styleProperties [in] array

+// Returns 2 arrays -- the style properties and their values

+//  useAlternateView=FALSE: gets properties for the default media type (usually screen)

+//  useAlternateView=TRUE: properties for media types set w/ nsIDOMSimpleDocument::set_alternateViewMediaTypes()

+//

+// get_parentNode     (/* [out] */ ISimpleDOMNode **newNodePtr);

+// get_firstChild     (/* [out] */ ISimpleDOMNode **newNodePtr);

+// get_lastChild      (/* [out] */ ISimpleDOMNode **newNodePtr);

+// get_previousSibling(/* [out] */ ISimpleDOMNode **newNodePtr);

+// get_nextSibling    (/* [out] */ ISimpleDOMNode **newNodePtr);

+// get_childAt        (/* [in] */ unsigned childIndex, /* [out] */ ISimpleDOMNode **newNodePtr);

+// ---------------------------------------------------------------------------------------------------=

+// DOM navigation - get a different node.

+//

+// get_innerHTML(/* [out] */ BSTR *htmlText);

+// ---------------------------------------------------------------------------------------------------=

+// Returns HTML of this DOM node's subtree. Does not include the start and end tag for this node/element.

+//

+//

+// get_localInterface(/* [out] */ void **localInterface);

+// ---------------------------------------------------------------------------------------------------=

+// Only available in Gecko's process - casts to an XPCOM nsIAccessNode interface pointer

+//

+//

+// get_language(/* [out] */ BSTR *htmlText);

+// ---------------------------------------------------------------------------------------------------=

+// Returns the computed language for this node, or empty string if unknown.

+//

+//

+///////////////////////////////////////////////////////////////////////////////////////////////////////

+

+

+#define	DISPID_NODE_NODEINFO	( -5900 )

+

+#define	DISPID_NODE_ATTRIBUTES	( -5901 )

+

+#define	DISPID_NODE_ATTRIBUTESFORNAMES	( -5902 )

+

+#define	DISPID_NODE_COMPSTYLE	( -5903 )

+

+#define	DISPID_NODE_COMPSTYLEFORPROPS	( -5904 )

+

+#define	DISPID_NODE_LANGUAGE	( -5905 )

+

+

+

+extern RPC_IF_HANDLE __MIDL_itf_ISimpleDOMNode_0000_0000_v0_0_c_ifspec;

+extern RPC_IF_HANDLE __MIDL_itf_ISimpleDOMNode_0000_0000_v0_0_s_ifspec;

+

+#ifndef __ISimpleDOMNode_INTERFACE_DEFINED__

+#define __ISimpleDOMNode_INTERFACE_DEFINED__

+

+/* interface ISimpleDOMNode */

+/* [uuid][object] */ 

+

+#define	NODETYPE_ELEMENT	( 1 )

+

+#define	NODETYPE_ATTRIBUTE	( 2 )

+

+#define	NODETYPE_TEXT	( 3 )

+

+#define	NODETYPE_CDATA_SECTION	( 4 )

+

+#define	NODETYPE_ENTITY_REFERENCE	( 5 )

+

+#define	NODETYPE_ENTITY	( 6 )

+

+#define	NODETYPE_PROCESSING_INSTRUCTION	( 7 )

+

+#define	NODETYPE_COMMENT	( 8 )

+

+#define	NODETYPE_DOCUMENT	( 9 )

+

+#define	NODETYPE_DOCUMENT_TYPE	( 10 )

+

+#define	NODETYPE_DOCUMENT_FRAGMENT	( 11 )

+

+#define	NODETYPE_NOTATION	( 12 )

+

+

+EXTERN_C const IID IID_ISimpleDOMNode;

+

+#if defined(__cplusplus) && !defined(CINTERFACE)

+    

+    MIDL_INTERFACE("1814ceeb-49e2-407f-af99-fa755a7d2607")

+    ISimpleDOMNode : public IUnknown

+    {

+    public:

+        virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_nodeInfo( 

+            /* [out] */ BSTR *nodeName,

+            /* [out] */ short *nameSpaceID,

+            /* [out] */ BSTR *nodeValue,

+            /* [out] */ unsigned int *numChildren,

+            /* [out] */ unsigned int *uniqueID,

+            /* [retval][out] */ unsigned short *nodeType) = 0;

+        

+        virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_attributes( 

+            /* [in] */ unsigned short maxAttribs,

+            /* [length_is][size_is][out] */ BSTR *attribNames,

+            /* [length_is][size_is][out] */ short *nameSpaceID,

+            /* [length_is][size_is][out] */ BSTR *attribValues,

+            /* [retval][out] */ unsigned short *numAttribs) = 0;

+        

+        virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_attributesForNames( 

+            /* [in] */ unsigned short numAttribs,

+            /* [length_is][size_is][in] */ BSTR *attribNames,

+            /* [length_is][size_is][in] */ short *nameSpaceID,

+            /* [length_is][size_is][retval][out] */ BSTR *attribValues) = 0;

+        

+        virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_computedStyle( 

+            /* [in] */ unsigned short maxStyleProperties,

+            /* [in] */ boolean useAlternateView,

+            /* [length_is][size_is][out] */ BSTR *styleProperties,

+            /* [length_is][size_is][out] */ BSTR *styleValues,

+            /* [retval][out] */ unsigned short *numStyleProperties) = 0;

+        

+        virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_computedStyleForProperties( 

+            /* [in] */ unsigned short numStyleProperties,

+            /* [in] */ boolean useAlternateView,

+            /* [length_is][size_is][in] */ BSTR *styleProperties,

+            /* [length_is][size_is][retval][out] */ BSTR *styleValues) = 0;

+        

+        virtual HRESULT STDMETHODCALLTYPE scrollTo( 

+            /* [in] */ boolean placeTopLeft) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_parentNode( 

+            /* [retval][out] */ ISimpleDOMNode **node) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_firstChild( 

+            /* [retval][out] */ ISimpleDOMNode **node) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_lastChild( 

+            /* [retval][out] */ ISimpleDOMNode **node) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_previousSibling( 

+            /* [retval][out] */ ISimpleDOMNode **node) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_nextSibling( 

+            /* [retval][out] */ ISimpleDOMNode **node) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_childAt( 

+            /* [in] */ unsigned int childIndex,

+            /* [retval][out] */ ISimpleDOMNode **node) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_innerHTML( 

+            /* [retval][out] */ BSTR *innerHTML) = 0;

+        

+        virtual /* [local][propget] */ HRESULT STDMETHODCALLTYPE get_localInterface( 

+            /* [retval][out] */ void **localInterface) = 0;

+        

+        virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_language( 

+            /* [retval][out] */ BSTR *language) = 0;

+        

+    };

+    

+    

+#else 	/* C style interface */

+

+    typedef struct ISimpleDOMNodeVtbl

+    {

+        BEGIN_INTERFACE

+        

+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 

+            ISimpleDOMNode * This,

+            /* [in] */ REFIID riid,

+            /* [annotation][iid_is][out] */ 

+            _COM_Outptr_  void **ppvObject);

+        

+        ULONG ( STDMETHODCALLTYPE *AddRef )( 

+            ISimpleDOMNode * This);

+        

+        ULONG ( STDMETHODCALLTYPE *Release )( 

+            ISimpleDOMNode * This);

+        

+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_nodeInfo )( 

+            ISimpleDOMNode * This,

+            /* [out] */ BSTR *nodeName,

+            /* [out] */ short *nameSpaceID,

+            /* [out] */ BSTR *nodeValue,

+            /* [out] */ unsigned int *numChildren,

+            /* [out] */ unsigned int *uniqueID,

+            /* [retval][out] */ unsigned short *nodeType);

+        

+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_attributes )( 

+            ISimpleDOMNode * This,

+            /* [in] */ unsigned short maxAttribs,

+            /* [length_is][size_is][out] */ BSTR *attribNames,

+            /* [length_is][size_is][out] */ short *nameSpaceID,

+            /* [length_is][size_is][out] */ BSTR *attribValues,

+            /* [retval][out] */ unsigned short *numAttribs);

+        

+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_attributesForNames )( 

+            ISimpleDOMNode * This,

+            /* [in] */ unsigned short numAttribs,

+            /* [length_is][size_is][in] */ BSTR *attribNames,

+            /* [length_is][size_is][in] */ short *nameSpaceID,

+            /* [length_is][size_is][retval][out] */ BSTR *attribValues);

+        

+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_computedStyle )( 

+            ISimpleDOMNode * This,

+            /* [in] */ unsigned short maxStyleProperties,

+            /* [in] */ boolean useAlternateView,

+            /* [length_is][size_is][out] */ BSTR *styleProperties,

+            /* [length_is][size_is][out] */ BSTR *styleValues,

+            /* [retval][out] */ unsigned short *numStyleProperties);

+        

+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_computedStyleForProperties )( 

+            ISimpleDOMNode * This,

+            /* [in] */ unsigned short numStyleProperties,

+            /* [in] */ boolean useAlternateView,

+            /* [length_is][size_is][in] */ BSTR *styleProperties,

+            /* [length_is][size_is][retval][out] */ BSTR *styleValues);

+        

+        HRESULT ( STDMETHODCALLTYPE *scrollTo )( 

+            ISimpleDOMNode * This,

+            /* [in] */ boolean placeTopLeft);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_parentNode )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ ISimpleDOMNode **node);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_firstChild )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ ISimpleDOMNode **node);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_lastChild )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ ISimpleDOMNode **node);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_previousSibling )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ ISimpleDOMNode **node);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_nextSibling )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ ISimpleDOMNode **node);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_childAt )( 

+            ISimpleDOMNode * This,

+            /* [in] */ unsigned int childIndex,

+            /* [retval][out] */ ISimpleDOMNode **node);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_innerHTML )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ BSTR *innerHTML);

+        

+        /* [local][propget] */ HRESULT ( STDMETHODCALLTYPE *get_localInterface )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ void **localInterface);

+        

+        /* [id][propget] */ HRESULT ( STDMETHODCALLTYPE *get_language )( 

+            ISimpleDOMNode * This,

+            /* [retval][out] */ BSTR *language);

+        

+        END_INTERFACE

+    } ISimpleDOMNodeVtbl;

+

+    interface ISimpleDOMNode

+    {

+        CONST_VTBL struct ISimpleDOMNodeVtbl *lpVtbl;

+    };

+

+    

+

+#ifdef COBJMACROS

+

+

+#define ISimpleDOMNode_QueryInterface(This,riid,ppvObject)	\

+    ( (This)->lpVtbl -> QueryInterface(This,riid,ppvObject) ) 

+

+#define ISimpleDOMNode_AddRef(This)	\

+    ( (This)->lpVtbl -> AddRef(This) ) 

+

+#define ISimpleDOMNode_Release(This)	\

+    ( (This)->lpVtbl -> Release(This) ) 

+

+

+#define ISimpleDOMNode_get_nodeInfo(This,nodeName,nameSpaceID,nodeValue,numChildren,uniqueID,nodeType)	\

+    ( (This)->lpVtbl -> get_nodeInfo(This,nodeName,nameSpaceID,nodeValue,numChildren,uniqueID,nodeType) ) 

+

+#define ISimpleDOMNode_get_attributes(This,maxAttribs,attribNames,nameSpaceID,attribValues,numAttribs)	\

+    ( (This)->lpVtbl -> get_attributes(This,maxAttribs,attribNames,nameSpaceID,attribValues,numAttribs) ) 

+

+#define ISimpleDOMNode_get_attributesForNames(This,numAttribs,attribNames,nameSpaceID,attribValues)	\

+    ( (This)->lpVtbl -> get_attributesForNames(This,numAttribs,attribNames,nameSpaceID,attribValues) ) 

+

+#define ISimpleDOMNode_get_computedStyle(This,maxStyleProperties,useAlternateView,styleProperties,styleValues,numStyleProperties)	\

+    ( (This)->lpVtbl -> get_computedStyle(This,maxStyleProperties,useAlternateView,styleProperties,styleValues,numStyleProperties) ) 

+

+#define ISimpleDOMNode_get_computedStyleForProperties(This,numStyleProperties,useAlternateView,styleProperties,styleValues)	\

+    ( (This)->lpVtbl -> get_computedStyleForProperties(This,numStyleProperties,useAlternateView,styleProperties,styleValues) ) 

+

+#define ISimpleDOMNode_scrollTo(This,placeTopLeft)	\

+    ( (This)->lpVtbl -> scrollTo(This,placeTopLeft) ) 

+

+#define ISimpleDOMNode_get_parentNode(This,node)	\

+    ( (This)->lpVtbl -> get_parentNode(This,node) ) 

+

+#define ISimpleDOMNode_get_firstChild(This,node)	\

+    ( (This)->lpVtbl -> get_firstChild(This,node) ) 

+

+#define ISimpleDOMNode_get_lastChild(This,node)	\

+    ( (This)->lpVtbl -> get_lastChild(This,node) ) 

+

+#define ISimpleDOMNode_get_previousSibling(This,node)	\

+    ( (This)->lpVtbl -> get_previousSibling(This,node) ) 

+

+#define ISimpleDOMNode_get_nextSibling(This,node)	\

+    ( (This)->lpVtbl -> get_nextSibling(This,node) ) 

+

+#define ISimpleDOMNode_get_childAt(This,childIndex,node)	\

+    ( (This)->lpVtbl -> get_childAt(This,childIndex,node) ) 

+

+#define ISimpleDOMNode_get_innerHTML(This,innerHTML)	\

+    ( (This)->lpVtbl -> get_innerHTML(This,innerHTML) ) 

+

+#define ISimpleDOMNode_get_localInterface(This,localInterface)	\

+    ( (This)->lpVtbl -> get_localInterface(This,localInterface) ) 

+

+#define ISimpleDOMNode_get_language(This,language)	\

+    ( (This)->lpVtbl -> get_language(This,language) ) 

+

+#endif /* COBJMACROS */

+

+

+#endif 	/* C style interface */

+

+

+

+

+#endif 	/* __ISimpleDOMNode_INTERFACE_DEFINED__ */

+

+

+/* Additional Prototypes for ALL interfaces */

+

+unsigned long             __RPC_USER  BSTR_UserSize(     unsigned long *, unsigned long            , BSTR * ); 

+unsigned char * __RPC_USER  BSTR_UserMarshal(  unsigned long *, unsigned char *, BSTR * ); 

+unsigned char * __RPC_USER  BSTR_UserUnmarshal(unsigned long *, unsigned char *, BSTR * ); 

+void                      __RPC_USER  BSTR_UserFree(     unsigned long *, BSTR * ); 

+

+/* end of Additional Prototypes */

+

+#ifdef __cplusplus

+}

+#endif

+

+#endif

+

+


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode_i.c b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode_i.c
new file mode 100644
index 0000000..9fc7af9
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode_i.c

@@ -0,0 +1,79 @@
+

+

+/* this ALWAYS GENERATED file contains the IIDs and CLSIDs */

+

+/* link this file in with the server and any clients */

+

+

+ /* File created by MIDL compiler version 8.01.0622 */

+/* at Mon Jan 18 22:14:07 2038

+ */

+/* Compiler settings for ../../third_party/isimpledom/ISimpleDOMNode.idl:

+    Oicf, W1, Zp8, env=Win32 (32b run), target_arch=X86 8.01.0622 

+    protocol : dce , ms_ext, c_ext, robust

+    error checks: allocation ref bounds_check enum stub_data 

+    VC __declspec() decoration level: 

+         __declspec(uuid()), __declspec(selectany), __declspec(novtable)

+         DECLSPEC_UUID(), MIDL_INTERFACE()

+*/

+/* @@MIDL_FILE_HEADING(  ) */

+

+#pragma warning( disable: 4049 )  /* more than 64k source lines */

+

+

+#ifdef __cplusplus

+extern "C"{

+#endif 

+

+

+#include <rpc.h>

+#include <rpcndr.h>

+

+#ifdef _MIDL_USE_GUIDDEF_

+

+#ifndef INITGUID

+#define INITGUID

+#include <guiddef.h>

+#undef INITGUID

+#else

+#include <guiddef.h>

+#endif

+

+#define MIDL_DEFINE_GUID(type,name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) \

+        DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8)

+

+#else // !_MIDL_USE_GUIDDEF_

+

+#ifndef __IID_DEFINED__

+#define __IID_DEFINED__

+

+typedef struct _IID

+{

+    unsigned long x;

+    unsigned short s1;

+    unsigned short s2;

+    unsigned char  c[8];

+} IID;

+

+#endif // __IID_DEFINED__

+

+#ifndef CLSID_DEFINED

+#define CLSID_DEFINED

+typedef IID CLSID;

+#endif // CLSID_DEFINED

+

+#define MIDL_DEFINE_GUID(type,name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) \

+        EXTERN_C __declspec(selectany) const type name = {l,w1,w2,{b1,b2,b3,b4,b5,b6,b7,b8}}

+

+#endif // !_MIDL_USE_GUIDDEF_

+

+MIDL_DEFINE_GUID(IID, IID_ISimpleDOMNode,0x1814ceeb,0x49e2,0x407f,0xaf,0x99,0xfa,0x75,0x5a,0x7d,0x26,0x07);

+

+#undef MIDL_DEFINE_GUID

+

+#ifdef __cplusplus

+}

+#endif

+

+

+


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode_p.c b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode_p.c
new file mode 100644
index 0000000..44125d9
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMNode_p.c

@@ -0,0 +1,1015 @@
+

+

+/* this ALWAYS GENERATED file contains the proxy stub code */

+

+

+ /* File created by MIDL compiler version 8.01.0622 */

+/* at Mon Jan 18 22:14:07 2038

+ */

+/* Compiler settings for ../../third_party/isimpledom/ISimpleDOMNode.idl:

+    Oicf, W1, Zp8, env=Win32 (32b run), target_arch=X86 8.01.0622 

+    protocol : dce , ms_ext, c_ext, robust

+    error checks: allocation ref bounds_check enum stub_data 

+    VC __declspec() decoration level: 

+         __declspec(uuid()), __declspec(selectany), __declspec(novtable)

+         DECLSPEC_UUID(), MIDL_INTERFACE()

+*/

+/* @@MIDL_FILE_HEADING(  ) */

+

+#if !defined(_M_IA64) && !defined(_M_AMD64) && !defined(_ARM_)

+

+

+#pragma warning( disable: 4049 )  /* more than 64k source lines */

+#if _MSC_VER >= 1200

+#pragma warning(push)

+#endif

+

+#pragma warning( disable: 4211 )  /* redefine extern to static */

+#pragma warning( disable: 4232 )  /* dllimport identity*/

+#pragma warning( disable: 4024 )  /* array to pointer mapping*/

+#pragma warning( disable: 4152 )  /* function/data pointer conversion in expression */

+#pragma warning( disable: 4100 ) /* unreferenced arguments in x86 call */

+

+#pragma optimize("", off ) 

+

+#define USE_STUBLESS_PROXY

+

+

+/* verify that the <rpcproxy.h> version is high enough to compile this file*/

+#ifndef __REDQ_RPCPROXY_H_VERSION__

+#define __REQUIRED_RPCPROXY_H_VERSION__ 475

+#endif

+

+

+#include "rpcproxy.h"

+#ifndef __RPCPROXY_H_VERSION__

+#error this stub requires an updated version of <rpcproxy.h>

+#endif /* __RPCPROXY_H_VERSION__ */

+

+

+#include "ISimpleDOMNode.h"

+

+#define TYPE_FORMAT_STRING_SIZE   209                               

+#define PROC_FORMAT_STRING_SIZE   625                               

+#define EXPR_FORMAT_STRING_SIZE   1                                 

+#define TRANSMIT_AS_TABLE_SIZE    0            

+#define WIRE_MARSHAL_TABLE_SIZE   1            

+

+typedef struct _ISimpleDOMNode_MIDL_TYPE_FORMAT_STRING

+    {

+    short          Pad;

+    unsigned char  Format[ TYPE_FORMAT_STRING_SIZE ];

+    } ISimpleDOMNode_MIDL_TYPE_FORMAT_STRING;

+

+typedef struct _ISimpleDOMNode_MIDL_PROC_FORMAT_STRING

+    {

+    short          Pad;

+    unsigned char  Format[ PROC_FORMAT_STRING_SIZE ];

+    } ISimpleDOMNode_MIDL_PROC_FORMAT_STRING;

+

+typedef struct _ISimpleDOMNode_MIDL_EXPR_FORMAT_STRING

+    {

+    long          Pad;

+    unsigned char  Format[ EXPR_FORMAT_STRING_SIZE ];

+    } ISimpleDOMNode_MIDL_EXPR_FORMAT_STRING;

+

+

+static const RPC_SYNTAX_IDENTIFIER  _RpcTransferSyntax = 

+{{0x8A885D04,0x1CEB,0x11C9,{0x9F,0xE8,0x08,0x00,0x2B,0x10,0x48,0x60}},{2,0}};

+

+

+extern const ISimpleDOMNode_MIDL_TYPE_FORMAT_STRING ISimpleDOMNode__MIDL_TypeFormatString;

+extern const ISimpleDOMNode_MIDL_PROC_FORMAT_STRING ISimpleDOMNode__MIDL_ProcFormatString;

+extern const ISimpleDOMNode_MIDL_EXPR_FORMAT_STRING ISimpleDOMNode__MIDL_ExprFormatString;

+

+

+extern const MIDL_STUB_DESC Object_StubDesc;

+

+

+extern const MIDL_SERVER_INFO ISimpleDOMNode_ServerInfo;

+extern const MIDL_STUBLESS_PROXY_INFO ISimpleDOMNode_ProxyInfo;

+

+

+extern const USER_MARSHAL_ROUTINE_QUADRUPLE UserMarshalRoutines[ WIRE_MARSHAL_TABLE_SIZE ];

+

+#if !defined(__RPC_WIN32__)

+#error  Invalid build platform for this stub.

+#endif

+

+#if !(TARGET_IS_NT50_OR_LATER)

+#error You need Windows 2000 or later to run this stub because it uses these features:

+#error   /robust command line switch.

+#error However, your C/C++ compilation flags indicate you intend to run this app on earlier systems.

+#error This app will fail with the RPC_X_WRONG_STUB_VERSION error.

+#endif

+

+

+static const ISimpleDOMNode_MIDL_PROC_FORMAT_STRING ISimpleDOMNode__MIDL_ProcFormatString =

+    {

+        0,

+        {

+

+	/* Procedure get_nodeInfo */

+

+			0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/*  2 */	NdrFcLong( 0x0 ),	/* 0 */

+/*  6 */	NdrFcShort( 0x3 ),	/* 3 */

+/*  8 */	NdrFcShort( 0x20 ),	/* x86 Stack size/offset = 32 */

+/* 10 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 12 */	NdrFcShort( 0x74 ),	/* 116 */

+/* 14 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x7,		/* 7 */

+/* 16 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 18 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 20 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 22 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter nodeName */

+

+/* 24 */	NdrFcShort( 0x2113 ),	/* Flags:  must size, must free, out, simple ref, srv alloc size=8 */

+/* 26 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 28 */	NdrFcShort( 0x20 ),	/* Type Offset=32 */

+

+	/* Parameter nameSpaceID */

+

+/* 30 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 32 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 34 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Parameter nodeValue */

+

+/* 36 */	NdrFcShort( 0x2113 ),	/* Flags:  must size, must free, out, simple ref, srv alloc size=8 */

+/* 38 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 40 */	NdrFcShort( 0x20 ),	/* Type Offset=32 */

+

+	/* Parameter numChildren */

+

+/* 42 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 44 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 46 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter uniqueID */

+

+/* 48 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 50 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 52 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter nodeType */

+

+/* 54 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 56 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 58 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 60 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 62 */	NdrFcShort( 0x1c ),	/* x86 Stack size/offset = 28 */

+/* 64 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_attributes */

+

+/* 66 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 68 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 72 */	NdrFcShort( 0x4 ),	/* 4 */

+/* 74 */	NdrFcShort( 0x1c ),	/* x86 Stack size/offset = 28 */

+/* 76 */	NdrFcShort( 0x6 ),	/* 6 */

+/* 78 */	NdrFcShort( 0x22 ),	/* 34 */

+/* 80 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x6,		/* 6 */

+/* 82 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 84 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 86 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 88 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter maxAttribs */

+

+/* 90 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 92 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 94 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Parameter attribNames */

+

+/* 96 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 98 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 100 */	NdrFcShort( 0x36 ),	/* Type Offset=54 */

+

+	/* Parameter nameSpaceID */

+

+/* 102 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 104 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 106 */	NdrFcShort( 0x50 ),	/* Type Offset=80 */

+

+	/* Parameter attribValues */

+

+/* 108 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 110 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 112 */	NdrFcShort( 0x36 ),	/* Type Offset=54 */

+

+	/* Parameter numAttribs */

+

+/* 114 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 116 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 118 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 120 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 122 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 124 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_attributesForNames */

+

+/* 126 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 128 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 132 */	NdrFcShort( 0x5 ),	/* 5 */

+/* 134 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 136 */	NdrFcShort( 0x6 ),	/* 6 */

+/* 138 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 140 */	0x47,		/* Oi2 Flags:  srv must size, clt must size, has return, has ext, */

+			0x5,		/* 5 */

+/* 142 */	0x8,		/* 8 */

+			0x7,		/* Ext Flags:  new corr desc, clt corr check, srv corr check, */

+/* 144 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 146 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 148 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter numAttribs */

+

+/* 150 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 152 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 154 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Parameter attribNames */

+

+/* 156 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */

+/* 158 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 160 */	NdrFcShort( 0x74 ),	/* Type Offset=116 */

+

+	/* Parameter nameSpaceID */

+

+/* 162 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */

+/* 164 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 166 */	NdrFcShort( 0x8e ),	/* Type Offset=142 */

+

+	/* Parameter attribValues */

+

+/* 168 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 170 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 172 */	NdrFcShort( 0xa4 ),	/* Type Offset=164 */

+

+	/* Return value */

+

+/* 174 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 176 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 178 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_computedStyle */

+

+/* 180 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 182 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 186 */	NdrFcShort( 0x6 ),	/* 6 */

+/* 188 */	NdrFcShort( 0x1c ),	/* x86 Stack size/offset = 28 */

+/* 190 */	NdrFcShort( 0xb ),	/* 11 */

+/* 192 */	NdrFcShort( 0x22 ),	/* 34 */

+/* 194 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x6,		/* 6 */

+/* 196 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 198 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 200 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 202 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter maxStyleProperties */

+

+/* 204 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 206 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 208 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Parameter useAlternateView */

+

+/* 210 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 212 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 214 */	0x3,		/* FC_SMALL */

+			0x0,		/* 0 */

+

+	/* Parameter styleProperties */

+

+/* 216 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 218 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 220 */	NdrFcShort( 0x36 ),	/* Type Offset=54 */

+

+	/* Parameter styleValues */

+

+/* 222 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 224 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 226 */	NdrFcShort( 0x36 ),	/* Type Offset=54 */

+

+	/* Parameter numStyleProperties */

+

+/* 228 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 230 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 232 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 234 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 236 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 238 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_computedStyleForProperties */

+

+/* 240 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 242 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 246 */	NdrFcShort( 0x7 ),	/* 7 */

+/* 248 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 250 */	NdrFcShort( 0xb ),	/* 11 */

+/* 252 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 254 */	0x47,		/* Oi2 Flags:  srv must size, clt must size, has return, has ext, */

+			0x5,		/* 5 */

+/* 256 */	0x8,		/* 8 */

+			0x7,		/* Ext Flags:  new corr desc, clt corr check, srv corr check, */

+/* 258 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 260 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 262 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter numStyleProperties */

+

+/* 264 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 266 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 268 */	0x6,		/* FC_SHORT */

+			0x0,		/* 0 */

+

+	/* Parameter useAlternateView */

+

+/* 270 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 272 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 274 */	0x3,		/* FC_SMALL */

+			0x0,		/* 0 */

+

+	/* Parameter styleProperties */

+

+/* 276 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */

+/* 278 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 280 */	NdrFcShort( 0x74 ),	/* Type Offset=116 */

+

+	/* Parameter styleValues */

+

+/* 282 */	NdrFcShort( 0x113 ),	/* Flags:  must size, must free, out, simple ref, */

+/* 284 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 286 */	NdrFcShort( 0xa4 ),	/* Type Offset=164 */

+

+	/* Return value */

+

+/* 288 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 290 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 292 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure scrollTo */

+

+/* 294 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 296 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 300 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 302 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 304 */	NdrFcShort( 0x5 ),	/* 5 */

+/* 306 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 308 */	0x44,		/* Oi2 Flags:  has return, has ext, */

+			0x2,		/* 2 */

+/* 310 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 312 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 314 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 316 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter placeTopLeft */

+

+/* 318 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 320 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 322 */	0x3,		/* FC_SMALL */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 324 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 326 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 328 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_parentNode */

+

+/* 330 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 332 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 336 */	NdrFcShort( 0x9 ),	/* 9 */

+/* 338 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 340 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 342 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 344 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 346 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 348 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 350 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 352 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter node */

+

+/* 354 */	NdrFcShort( 0x13 ),	/* Flags:  must size, must free, out, */

+/* 356 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 358 */	NdrFcShort( 0xba ),	/* Type Offset=186 */

+

+	/* Return value */

+

+/* 360 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 362 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 364 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_firstChild */

+

+/* 366 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 368 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 372 */	NdrFcShort( 0xa ),	/* 10 */

+/* 374 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 376 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 378 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 380 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 382 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 384 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 386 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 388 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter node */

+

+/* 390 */	NdrFcShort( 0x13 ),	/* Flags:  must size, must free, out, */

+/* 392 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 394 */	NdrFcShort( 0xba ),	/* Type Offset=186 */

+

+	/* Return value */

+

+/* 396 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 398 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 400 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_lastChild */

+

+/* 402 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 404 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 408 */	NdrFcShort( 0xb ),	/* 11 */

+/* 410 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 412 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 414 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 416 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 418 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 420 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 422 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 424 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter node */

+

+/* 426 */	NdrFcShort( 0x13 ),	/* Flags:  must size, must free, out, */

+/* 428 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 430 */	NdrFcShort( 0xba ),	/* Type Offset=186 */

+

+	/* Return value */

+

+/* 432 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 434 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 436 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_previousSibling */

+

+/* 438 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 440 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 444 */	NdrFcShort( 0xc ),	/* 12 */

+/* 446 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 448 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 450 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 452 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 454 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 456 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 458 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 460 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter node */

+

+/* 462 */	NdrFcShort( 0x13 ),	/* Flags:  must size, must free, out, */

+/* 464 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 466 */	NdrFcShort( 0xba ),	/* Type Offset=186 */

+

+	/* Return value */

+

+/* 468 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 470 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 472 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_nextSibling */

+

+/* 474 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 476 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 480 */	NdrFcShort( 0xd ),	/* 13 */

+/* 482 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 484 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 486 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 488 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 490 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 492 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 494 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 496 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter node */

+

+/* 498 */	NdrFcShort( 0x13 ),	/* Flags:  must size, must free, out, */

+/* 500 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 502 */	NdrFcShort( 0xba ),	/* Type Offset=186 */

+

+	/* Return value */

+

+/* 504 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 506 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 508 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_childAt */

+

+/* 510 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 512 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 516 */	NdrFcShort( 0xe ),	/* 14 */

+/* 518 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 520 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 522 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 524 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x3,		/* 3 */

+/* 526 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 528 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 530 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 532 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter childIndex */

+

+/* 534 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 536 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 538 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter node */

+

+/* 540 */	NdrFcShort( 0x13 ),	/* Flags:  must size, must free, out, */

+/* 542 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 544 */	NdrFcShort( 0xba ),	/* Type Offset=186 */

+

+	/* Return value */

+

+/* 546 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 548 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 550 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_innerHTML */

+

+/* 552 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 554 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 558 */	NdrFcShort( 0xf ),	/* 15 */

+/* 560 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 562 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 564 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 566 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 568 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 570 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 572 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 574 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter innerHTML */

+

+/* 576 */	NdrFcShort( 0x2113 ),	/* Flags:  must size, must free, out, simple ref, srv alloc size=8 */

+/* 578 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 580 */	NdrFcShort( 0x20 ),	/* Type Offset=32 */

+

+	/* Return value */

+

+/* 582 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 584 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 586 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_language */

+

+/* 588 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 590 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 594 */	NdrFcShort( 0x11 ),	/* 17 */

+/* 596 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 598 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 600 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 602 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 604 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 606 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 608 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 610 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter language */

+

+/* 612 */	NdrFcShort( 0x2113 ),	/* Flags:  must size, must free, out, simple ref, srv alloc size=8 */

+/* 614 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 616 */	NdrFcShort( 0x20 ),	/* Type Offset=32 */

+

+	/* Return value */

+

+/* 618 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 620 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 622 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+			0x0

+        }

+    };

+

+static const ISimpleDOMNode_MIDL_TYPE_FORMAT_STRING ISimpleDOMNode__MIDL_TypeFormatString =

+    {

+        0,

+        {

+			NdrFcShort( 0x0 ),	/* 0 */

+/*  2 */	

+			0x11, 0x4,	/* FC_RP [alloced_on_stack] */

+/*  4 */	NdrFcShort( 0x1c ),	/* Offset= 28 (32) */

+/*  6 */	

+			0x13, 0x0,	/* FC_OP */

+/*  8 */	NdrFcShort( 0xe ),	/* Offset= 14 (22) */

+/* 10 */	

+			0x1b,		/* FC_CARRAY */

+			0x1,		/* 1 */

+/* 12 */	NdrFcShort( 0x2 ),	/* 2 */

+/* 14 */	0x9,		/* Corr desc: FC_ULONG */

+			0x0,		/*  */

+/* 16 */	NdrFcShort( 0xfffc ),	/* -4 */

+/* 18 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 20 */	0x6,		/* FC_SHORT */

+			0x5b,		/* FC_END */

+/* 22 */	

+			0x17,		/* FC_CSTRUCT */

+			0x3,		/* 3 */

+/* 24 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 26 */	NdrFcShort( 0xfff0 ),	/* Offset= -16 (10) */

+/* 28 */	0x8,		/* FC_LONG */

+			0x8,		/* FC_LONG */

+/* 30 */	0x5c,		/* FC_PAD */

+			0x5b,		/* FC_END */

+/* 32 */	0xb4,		/* FC_USER_MARSHAL */

+			0x83,		/* 131 */

+/* 34 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 36 */	NdrFcShort( 0x4 ),	/* 4 */

+/* 38 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 40 */	NdrFcShort( 0xffde ),	/* Offset= -34 (6) */

+/* 42 */	

+			0x11, 0xc,	/* FC_RP [alloced_on_stack] [simple_pointer] */

+/* 44 */	0x6,		/* FC_SHORT */

+			0x5c,		/* FC_PAD */

+/* 46 */	

+			0x11, 0xc,	/* FC_RP [alloced_on_stack] [simple_pointer] */

+/* 48 */	0x8,		/* FC_LONG */

+			0x5c,		/* FC_PAD */

+/* 50 */	

+			0x11, 0x0,	/* FC_RP */

+/* 52 */	NdrFcShort( 0x2 ),	/* Offset= 2 (54) */

+/* 54 */	

+			0x21,		/* FC_BOGUS_ARRAY */

+			0x3,		/* 3 */

+/* 56 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 58 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 60 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 62 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 64 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x54,		/* FC_DEREFERENCE */

+/* 66 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 68 */	NdrFcShort( 0x0 ),	/* Corr flags:  */

+/* 70 */	0x4c,		/* FC_EMBEDDED_COMPLEX */

+			0x0,		/* 0 */

+/* 72 */	NdrFcShort( 0xffd8 ),	/* Offset= -40 (32) */

+/* 74 */	0x5c,		/* FC_PAD */

+			0x5b,		/* FC_END */

+/* 76 */	

+			0x11, 0x0,	/* FC_RP */

+/* 78 */	NdrFcShort( 0x2 ),	/* Offset= 2 (80) */

+/* 80 */	

+			0x1c,		/* FC_CVARRAY */

+			0x1,		/* 1 */

+/* 82 */	NdrFcShort( 0x2 ),	/* 2 */

+/* 84 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 86 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 88 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 90 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x54,		/* FC_DEREFERENCE */

+/* 92 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 94 */	NdrFcShort( 0x0 ),	/* Corr flags:  */

+/* 96 */	0x6,		/* FC_SHORT */

+			0x5b,		/* FC_END */

+/* 98 */	

+			0x11, 0x0,	/* FC_RP */

+/* 100 */	NdrFcShort( 0x10 ),	/* Offset= 16 (116) */

+/* 102 */	

+			0x12, 0x0,	/* FC_UP */

+/* 104 */	NdrFcShort( 0xffae ),	/* Offset= -82 (22) */

+/* 106 */	0xb4,		/* FC_USER_MARSHAL */

+			0x83,		/* 131 */

+/* 108 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 110 */	NdrFcShort( 0x4 ),	/* 4 */

+/* 112 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 114 */	NdrFcShort( 0xfff4 ),	/* Offset= -12 (102) */

+/* 116 */	

+			0x21,		/* FC_BOGUS_ARRAY */

+			0x3,		/* 3 */

+/* 118 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 120 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 122 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 124 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 126 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 128 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 130 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 132 */	0x4c,		/* FC_EMBEDDED_COMPLEX */

+			0x0,		/* 0 */

+/* 134 */	NdrFcShort( 0xffe4 ),	/* Offset= -28 (106) */

+/* 136 */	0x5c,		/* FC_PAD */

+			0x5b,		/* FC_END */

+/* 138 */	

+			0x11, 0x0,	/* FC_RP */

+/* 140 */	NdrFcShort( 0x2 ),	/* Offset= 2 (142) */

+/* 142 */	

+			0x1c,		/* FC_CVARRAY */

+			0x1,		/* 1 */

+/* 144 */	NdrFcShort( 0x2 ),	/* 2 */

+/* 146 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 148 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 150 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 152 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 154 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 156 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 158 */	0x6,		/* FC_SHORT */

+			0x5b,		/* FC_END */

+/* 160 */	

+			0x11, 0x0,	/* FC_RP */

+/* 162 */	NdrFcShort( 0x2 ),	/* Offset= 2 (164) */

+/* 164 */	

+			0x21,		/* FC_BOGUS_ARRAY */

+			0x3,		/* 3 */

+/* 166 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 168 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 170 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 172 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 174 */	0x27,		/* Corr desc:  parameter, FC_USHORT */

+			0x0,		/*  */

+/* 176 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 178 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 180 */	0x4c,		/* FC_EMBEDDED_COMPLEX */

+			0x0,		/* 0 */

+/* 182 */	NdrFcShort( 0xff6a ),	/* Offset= -150 (32) */

+/* 184 */	0x5c,		/* FC_PAD */

+			0x5b,		/* FC_END */

+/* 186 */	

+			0x11, 0x10,	/* FC_RP [pointer_deref] */

+/* 188 */	NdrFcShort( 0x2 ),	/* Offset= 2 (190) */

+/* 190 */	

+			0x2f,		/* FC_IP */

+			0x5a,		/* FC_CONSTANT_IID */

+/* 192 */	NdrFcLong( 0x1814ceeb ),	/* 404016875 */

+/* 196 */	NdrFcShort( 0x49e2 ),	/* 18914 */

+/* 198 */	NdrFcShort( 0x407f ),	/* 16511 */

+/* 200 */	0xaf,		/* 175 */

+			0x99,		/* 153 */

+/* 202 */	0xfa,		/* 250 */

+			0x75,		/* 117 */

+/* 204 */	0x5a,		/* 90 */

+			0x7d,		/* 125 */

+/* 206 */	0x26,		/* 38 */

+			0x7,		/* 7 */

+

+			0x0

+        }

+    };

+

+static const USER_MARSHAL_ROUTINE_QUADRUPLE UserMarshalRoutines[ WIRE_MARSHAL_TABLE_SIZE ] = 

+        {

+            

+            {

+            BSTR_UserSize

+            ,BSTR_UserMarshal

+            ,BSTR_UserUnmarshal

+            ,BSTR_UserFree

+            }

+

+        };

+

+

+

+/* Standard interface: __MIDL_itf_ISimpleDOMNode_0000_0000, ver. 0.0,

+   GUID={0x00000000,0x0000,0x0000,{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}} */

+

+

+/* Object interface: IUnknown, ver. 0.0,

+   GUID={0x00000000,0x0000,0x0000,{0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46}} */

+

+

+/* Object interface: ISimpleDOMNode, ver. 0.0,

+   GUID={0x1814ceeb,0x49e2,0x407f,{0xaf,0x99,0xfa,0x75,0x5a,0x7d,0x26,0x07}} */

+

+#pragma code_seg(".orpc")

+static const unsigned short ISimpleDOMNode_FormatStringOffsetTable[] =

+    {

+    0,

+    66,

+    126,

+    180,

+    240,

+    294,

+    330,

+    366,

+    402,

+    438,

+    474,

+    510,

+    552,

+    (unsigned short) -1,

+    588

+    };

+

+static const MIDL_STUBLESS_PROXY_INFO ISimpleDOMNode_ProxyInfo =

+    {

+    &Object_StubDesc,

+    ISimpleDOMNode__MIDL_ProcFormatString.Format,

+    &ISimpleDOMNode_FormatStringOffsetTable[-3],

+    0,

+    0,

+    0

+    };

+

+

+static const MIDL_SERVER_INFO ISimpleDOMNode_ServerInfo = 

+    {

+    &Object_StubDesc,

+    0,

+    ISimpleDOMNode__MIDL_ProcFormatString.Format,

+    &ISimpleDOMNode_FormatStringOffsetTable[-3],

+    0,

+    0,

+    0,

+    0};

+CINTERFACE_PROXY_VTABLE(18) _ISimpleDOMNodeProxyVtbl = 

+{

+    &ISimpleDOMNode_ProxyInfo,

+    &IID_ISimpleDOMNode,

+    IUnknown_QueryInterface_Proxy,

+    IUnknown_AddRef_Proxy,

+    IUnknown_Release_Proxy ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_nodeInfo */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_attributes */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_attributesForNames */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_computedStyle */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_computedStyleForProperties */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::scrollTo */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_parentNode */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_firstChild */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_lastChild */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_previousSibling */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_nextSibling */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_childAt */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_innerHTML */ ,

+    0 /* ISimpleDOMNode::get_localInterface */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMNode::get_language */

+};

+

+const CInterfaceStubVtbl _ISimpleDOMNodeStubVtbl =

+{

+    &IID_ISimpleDOMNode,

+    &ISimpleDOMNode_ServerInfo,

+    18,

+    0, /* pure interpreted */

+    CStdStubBuffer_METHODS

+};

+

+static const MIDL_STUB_DESC Object_StubDesc = 

+    {

+    0,

+    NdrOleAllocate,

+    NdrOleFree,

+    0,

+    0,

+    0,

+    0,

+    0,

+    ISimpleDOMNode__MIDL_TypeFormatString.Format,

+    1, /* -error bounds_check flag */

+    0x50002, /* Ndr library version */

+    0,

+    0x801026e, /* MIDL Version 8.1.622 */

+    0,

+    UserMarshalRoutines,

+    0,  /* notify & notify_flag routine table */

+    0x1, /* MIDL flag */

+    0, /* cs routines */

+    0,   /* proxy/server info */

+    0

+    };

+

+const CInterfaceProxyVtbl * const _ISimpleDOMNode_ProxyVtblList[] = 

+{

+    ( CInterfaceProxyVtbl *) &_ISimpleDOMNodeProxyVtbl,

+    0

+};

+

+const CInterfaceStubVtbl * const _ISimpleDOMNode_StubVtblList[] = 

+{

+    ( CInterfaceStubVtbl *) &_ISimpleDOMNodeStubVtbl,

+    0

+};

+

+PCInterfaceName const _ISimpleDOMNode_InterfaceNamesList[] = 

+{

+    "ISimpleDOMNode",

+    0

+};

+

+

+#define _ISimpleDOMNode_CHECK_IID(n)	IID_GENERIC_CHECK_IID( _ISimpleDOMNode, pIID, n)

+

+int __stdcall _ISimpleDOMNode_IID_Lookup( const IID * pIID, int * pIndex )

+{

+    

+    if(!_ISimpleDOMNode_CHECK_IID(0))

+        {

+        *pIndex = 0;

+        return 1;

+        }

+

+    return 0;

+}

+

+const ExtendedProxyFileInfo ISimpleDOMNode_ProxyFileInfo = 

+{

+    (PCInterfaceProxyVtblList *) & _ISimpleDOMNode_ProxyVtblList,

+    (PCInterfaceStubVtblList *) & _ISimpleDOMNode_StubVtblList,

+    (const PCInterfaceName * ) & _ISimpleDOMNode_InterfaceNamesList,

+    0, /* no delegation */

+    & _ISimpleDOMNode_IID_Lookup, 

+    1,

+    2,

+    0, /* table of [async_uuid] interfaces */

+    0, /* Filler1 */

+    0, /* Filler2 */

+    0  /* Filler3 */

+};

+#if _MSC_VER >= 1200

+#pragma warning(pop)

+#endif

+

+

+#endif /* !defined(_M_IA64) && !defined(_M_AMD64) && !defined(_ARM_) */

+


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText.dlldata.c b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText.dlldata.c
new file mode 100644
index 0000000..848ca457
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText.dlldata.c

@@ -0,0 +1,37 @@
+/*********************************************************

+   DllData file -- generated by MIDL compiler 

+

+        DO NOT ALTER THIS FILE

+

+   This file is regenerated by MIDL on every IDL file compile.

+

+   To completely reconstruct this file, delete it and rerun MIDL

+   on all the IDL files in this DLL, specifying this file for the

+   /dlldata command line option

+

+*********************************************************/

+

+

+#include <rpcproxy.h>

+

+#ifdef __cplusplus

+extern "C"   {

+#endif

+

+EXTERN_PROXY_FILE( ISimpleDOMText )

+

+

+PROXYFILE_LIST_START

+/* Start of list */

+  REFERENCE_PROXY_FILE( ISimpleDOMText ),

+/* End of list */

+PROXYFILE_LIST_END

+

+

+DLLDATA_ROUTINES( aProxyFileList, GET_DLL_CLSID )

+

+#ifdef __cplusplus

+}  /*extern "C" */

+#endif

+

+/* end of generated dlldata file */


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText.h b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText.h
new file mode 100644
index 0000000..97281ba
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText.h

@@ -0,0 +1,274 @@
+

+

+/* this ALWAYS GENERATED file contains the definitions for the interfaces */

+

+

+ /* File created by MIDL compiler version 8.01.0622 */

+/* at Mon Jan 18 22:14:07 2038

+ */

+/* Compiler settings for ../../third_party/isimpledom/ISimpleDOMText.idl:

+    Oicf, W1, Zp8, env=Win32 (32b run), target_arch=X86 8.01.0622 

+    protocol : dce , ms_ext, c_ext, robust

+    error checks: allocation ref bounds_check enum stub_data 

+    VC __declspec() decoration level: 

+         __declspec(uuid()), __declspec(selectany), __declspec(novtable)

+         DECLSPEC_UUID(), MIDL_INTERFACE()

+*/

+/* @@MIDL_FILE_HEADING(  ) */

+

+#pragma warning( disable: 4049 )  /* more than 64k source lines */

+

+

+/* verify that the <rpcndr.h> version is high enough to compile this file*/

+#ifndef __REQUIRED_RPCNDR_H_VERSION__

+#define __REQUIRED_RPCNDR_H_VERSION__ 475

+#endif

+

+#include "rpc.h"

+#include "rpcndr.h"

+

+#ifndef __RPCNDR_H_VERSION__

+#error this stub requires an updated version of <rpcndr.h>

+#endif /* __RPCNDR_H_VERSION__ */

+

+#ifndef COM_NO_WINDOWS_H

+#include "windows.h"

+#include "ole2.h"

+#endif /*COM_NO_WINDOWS_H*/

+

+#ifndef __ISimpleDOMText_h__

+#define __ISimpleDOMText_h__

+

+#if defined(_MSC_VER) && (_MSC_VER >= 1020)

+#pragma once

+#endif

+

+/* Forward Declarations */ 

+

+#ifndef __ISimpleDOMText_FWD_DEFINED__

+#define __ISimpleDOMText_FWD_DEFINED__

+typedef interface ISimpleDOMText ISimpleDOMText;

+

+#endif 	/* __ISimpleDOMText_FWD_DEFINED__ */

+

+

+/* header files for imported files */

+#include "objidl.h"

+#include "oaidl.h"

+

+#ifdef __cplusplus

+extern "C"{

+#endif 

+

+

+/* interface __MIDL_itf_ISimpleDOMText_0000_0000 */

+/* [local] */ 

+

+///////////////////////////////////////////////////////////////////////////////////////////////////////

+//

+// ISimpleDOMText

+// ---------------------------------------------------------------------------------------------------=

+// An interface that extends MSAA's IAccessible to provide important additional capabilities on text nodes

+//

+// @STATUS UNDER_REVIEW

+//

+// [propget] domText(/* out,retval */ BSTR *domText

+// ---------------------------------------------------------------------------------------------------=

+// Similar to IAccessible::get_accName, but does not strip out whitespace characters.

+// Important for retrieving the correct start/end substring indices to use with other

+// methods in ISimpleDOMText.

+//

+//

+// get_[un]clippedSubstringBounds(

+//   /* [in] */ unsigned int startIndex,

+//   /* [in] */ unsigned int endIndex,

+//   /* [out] */ int *x,

+//   /* [out] */ int *y,

+//   /* [out] */ int *width,

+//   /* [out] */ int *height);

+// ---------------------------------------------------------------------------------------------------=

+// Both methods get_clippedSubstringBounds and get_unclippedSubstringBounds return the screen pixel

+// coordinates of the given text substring. The in parameters for start and end indices refer

+// to the string returned by ISimpleDOMText::get_domText().

+//

+//

+// scrollToSubstring(

+//   /* [in] */ unsigned int startIndex,

+//   /* [in] */ unsigned int endIndex);

+// ---------------------------------------------------------------------------------------------------=

+// In scrollable views, scrolls to ensure that the specified substring is visible onscreen.

+// The in parameters for start and end indices refer to the string returned

+// by ISimpleDOMText::get_domText().

+//

+//

+// [propget] fontFamily(/* out,retval */ BSTR *fontFamily);

+// ---------------------------------------------------------------------------------------------------=

+// Return a single computed font family name, which is better than the comma delineated list

+// that is returned by the ISimpleDOMNode computed style methods for font-family.

+// In other words, return something like 'Arial' instead of 'Arial, Helvetica, Sans-serif'.

+///////////////////////////////////////////////////////////////////////////////////////////////////////

+

+

+

+

+extern RPC_IF_HANDLE __MIDL_itf_ISimpleDOMText_0000_0000_v0_0_c_ifspec;

+extern RPC_IF_HANDLE __MIDL_itf_ISimpleDOMText_0000_0000_v0_0_s_ifspec;

+

+#ifndef __ISimpleDOMText_INTERFACE_DEFINED__

+#define __ISimpleDOMText_INTERFACE_DEFINED__

+

+/* interface ISimpleDOMText */

+/* [uuid][object] */ 

+

+

+EXTERN_C const IID IID_ISimpleDOMText;

+

+#if defined(__cplusplus) && !defined(CINTERFACE)

+    

+    MIDL_INTERFACE("4e747be5-2052-4265-8af0-8ecad7aad1c0")

+    ISimpleDOMText : public IUnknown

+    {

+    public:

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_domText( 

+            /* [retval][out] */ BSTR *domText) = 0;

+        

+        virtual HRESULT STDMETHODCALLTYPE get_clippedSubstringBounds( 

+            /* [in] */ unsigned int startIndex,

+            /* [in] */ unsigned int endIndex,

+            /* [out] */ int *x,

+            /* [out] */ int *y,

+            /* [out] */ int *width,

+            /* [out] */ int *height) = 0;

+        

+        virtual HRESULT STDMETHODCALLTYPE get_unclippedSubstringBounds( 

+            /* [in] */ unsigned int startIndex,

+            /* [in] */ unsigned int endIndex,

+            /* [out] */ int *x,

+            /* [out] */ int *y,

+            /* [out] */ int *width,

+            /* [out] */ int *height) = 0;

+        

+        virtual HRESULT STDMETHODCALLTYPE scrollToSubstring( 

+            /* [in] */ unsigned int startIndex,

+            /* [in] */ unsigned int endIndex) = 0;

+        

+        virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_fontFamily( 

+            /* [retval][out] */ BSTR *fontFamily) = 0;

+        

+    };

+    

+    

+#else 	/* C style interface */

+

+    typedef struct ISimpleDOMTextVtbl

+    {

+        BEGIN_INTERFACE

+        

+        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 

+            ISimpleDOMText * This,

+            /* [in] */ REFIID riid,

+            /* [annotation][iid_is][out] */ 

+            _COM_Outptr_  void **ppvObject);

+        

+        ULONG ( STDMETHODCALLTYPE *AddRef )( 

+            ISimpleDOMText * This);

+        

+        ULONG ( STDMETHODCALLTYPE *Release )( 

+            ISimpleDOMText * This);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_domText )( 

+            ISimpleDOMText * This,

+            /* [retval][out] */ BSTR *domText);

+        

+        HRESULT ( STDMETHODCALLTYPE *get_clippedSubstringBounds )( 

+            ISimpleDOMText * This,

+            /* [in] */ unsigned int startIndex,

+            /* [in] */ unsigned int endIndex,

+            /* [out] */ int *x,

+            /* [out] */ int *y,

+            /* [out] */ int *width,

+            /* [out] */ int *height);

+        

+        HRESULT ( STDMETHODCALLTYPE *get_unclippedSubstringBounds )( 

+            ISimpleDOMText * This,

+            /* [in] */ unsigned int startIndex,

+            /* [in] */ unsigned int endIndex,

+            /* [out] */ int *x,

+            /* [out] */ int *y,

+            /* [out] */ int *width,

+            /* [out] */ int *height);

+        

+        HRESULT ( STDMETHODCALLTYPE *scrollToSubstring )( 

+            ISimpleDOMText * This,

+            /* [in] */ unsigned int startIndex,

+            /* [in] */ unsigned int endIndex);

+        

+        /* [propget] */ HRESULT ( STDMETHODCALLTYPE *get_fontFamily )( 

+            ISimpleDOMText * This,

+            /* [retval][out] */ BSTR *fontFamily);

+        

+        END_INTERFACE

+    } ISimpleDOMTextVtbl;

+

+    interface ISimpleDOMText

+    {

+        CONST_VTBL struct ISimpleDOMTextVtbl *lpVtbl;

+    };

+

+    

+

+#ifdef COBJMACROS

+

+

+#define ISimpleDOMText_QueryInterface(This,riid,ppvObject)	\

+    ( (This)->lpVtbl -> QueryInterface(This,riid,ppvObject) ) 

+

+#define ISimpleDOMText_AddRef(This)	\

+    ( (This)->lpVtbl -> AddRef(This) ) 

+

+#define ISimpleDOMText_Release(This)	\

+    ( (This)->lpVtbl -> Release(This) ) 

+

+

+#define ISimpleDOMText_get_domText(This,domText)	\

+    ( (This)->lpVtbl -> get_domText(This,domText) ) 

+

+#define ISimpleDOMText_get_clippedSubstringBounds(This,startIndex,endIndex,x,y,width,height)	\

+    ( (This)->lpVtbl -> get_clippedSubstringBounds(This,startIndex,endIndex,x,y,width,height) ) 

+

+#define ISimpleDOMText_get_unclippedSubstringBounds(This,startIndex,endIndex,x,y,width,height)	\

+    ( (This)->lpVtbl -> get_unclippedSubstringBounds(This,startIndex,endIndex,x,y,width,height) ) 

+

+#define ISimpleDOMText_scrollToSubstring(This,startIndex,endIndex)	\

+    ( (This)->lpVtbl -> scrollToSubstring(This,startIndex,endIndex) ) 

+

+#define ISimpleDOMText_get_fontFamily(This,fontFamily)	\

+    ( (This)->lpVtbl -> get_fontFamily(This,fontFamily) ) 

+

+#endif /* COBJMACROS */

+

+

+#endif 	/* C style interface */

+

+

+

+

+#endif 	/* __ISimpleDOMText_INTERFACE_DEFINED__ */

+

+

+/* Additional Prototypes for ALL interfaces */

+

+unsigned long             __RPC_USER  BSTR_UserSize(     unsigned long *, unsigned long            , BSTR * ); 

+unsigned char * __RPC_USER  BSTR_UserMarshal(  unsigned long *, unsigned char *, BSTR * ); 

+unsigned char * __RPC_USER  BSTR_UserUnmarshal(unsigned long *, unsigned char *, BSTR * ); 

+void                      __RPC_USER  BSTR_UserFree(     unsigned long *, BSTR * ); 

+

+/* end of Additional Prototypes */

+

+#ifdef __cplusplus

+}

+#endif

+

+#endif

+

+


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText_i.c b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText_i.c
new file mode 100644
index 0000000..8f46be9
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText_i.c

@@ -0,0 +1,79 @@
+

+

+/* this ALWAYS GENERATED file contains the IIDs and CLSIDs */

+

+/* link this file in with the server and any clients */

+

+

+ /* File created by MIDL compiler version 8.01.0622 */

+/* at Mon Jan 18 22:14:07 2038

+ */

+/* Compiler settings for ../../third_party/isimpledom/ISimpleDOMText.idl:

+    Oicf, W1, Zp8, env=Win32 (32b run), target_arch=X86 8.01.0622 

+    protocol : dce , ms_ext, c_ext, robust

+    error checks: allocation ref bounds_check enum stub_data 

+    VC __declspec() decoration level: 

+         __declspec(uuid()), __declspec(selectany), __declspec(novtable)

+         DECLSPEC_UUID(), MIDL_INTERFACE()

+*/

+/* @@MIDL_FILE_HEADING(  ) */

+

+#pragma warning( disable: 4049 )  /* more than 64k source lines */

+

+

+#ifdef __cplusplus

+extern "C"{

+#endif 

+

+

+#include <rpc.h>

+#include <rpcndr.h>

+

+#ifdef _MIDL_USE_GUIDDEF_

+

+#ifndef INITGUID

+#define INITGUID

+#include <guiddef.h>

+#undef INITGUID

+#else

+#include <guiddef.h>

+#endif

+

+#define MIDL_DEFINE_GUID(type,name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) \

+        DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8)

+

+#else // !_MIDL_USE_GUIDDEF_

+

+#ifndef __IID_DEFINED__

+#define __IID_DEFINED__

+

+typedef struct _IID

+{

+    unsigned long x;

+    unsigned short s1;

+    unsigned short s2;

+    unsigned char  c[8];

+} IID;

+

+#endif // __IID_DEFINED__

+

+#ifndef CLSID_DEFINED

+#define CLSID_DEFINED

+typedef IID CLSID;

+#endif // CLSID_DEFINED

+

+#define MIDL_DEFINE_GUID(type,name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) \

+        EXTERN_C __declspec(selectany) const type name = {l,w1,w2,{b1,b2,b3,b4,b5,b6,b7,b8}}

+

+#endif // !_MIDL_USE_GUIDDEF_

+

+MIDL_DEFINE_GUID(IID, IID_ISimpleDOMText,0x4e747be5,0x2052,0x4265,0x8a,0xf0,0x8e,0xca,0xd7,0xaa,0xd1,0xc0);

+

+#undef MIDL_DEFINE_GUID

+

+#ifdef __cplusplus

+}

+#endif

+

+

+


diff --git a/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText_p.c b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText_p.c
new file mode 100644
index 0000000..a7ebee7
--- /dev/null
+++ b/third_party/win_build_output/midl/third_party/isimpledom/ISimpleDOMText_p.c

@@ -0,0 +1,547 @@
+

+

+/* this ALWAYS GENERATED file contains the proxy stub code */

+

+

+ /* File created by MIDL compiler version 8.01.0622 */

+/* at Mon Jan 18 22:14:07 2038

+ */

+/* Compiler settings for ../../third_party/isimpledom/ISimpleDOMText.idl:

+    Oicf, W1, Zp8, env=Win32 (32b run), target_arch=X86 8.01.0622 

+    protocol : dce , ms_ext, c_ext, robust

+    error checks: allocation ref bounds_check enum stub_data 

+    VC __declspec() decoration level: 

+         __declspec(uuid()), __declspec(selectany), __declspec(novtable)

+         DECLSPEC_UUID(), MIDL_INTERFACE()

+*/

+/* @@MIDL_FILE_HEADING(  ) */

+

+#if !defined(_M_IA64) && !defined(_M_AMD64) && !defined(_ARM_)

+

+

+#pragma warning( disable: 4049 )  /* more than 64k source lines */

+#if _MSC_VER >= 1200

+#pragma warning(push)

+#endif

+

+#pragma warning( disable: 4211 )  /* redefine extern to static */

+#pragma warning( disable: 4232 )  /* dllimport identity*/

+#pragma warning( disable: 4024 )  /* array to pointer mapping*/

+#pragma warning( disable: 4152 )  /* function/data pointer conversion in expression */

+#pragma warning( disable: 4100 ) /* unreferenced arguments in x86 call */

+

+#pragma optimize("", off ) 

+

+#define USE_STUBLESS_PROXY

+

+

+/* verify that the <rpcproxy.h> version is high enough to compile this file*/

+#ifndef __REDQ_RPCPROXY_H_VERSION__

+#define __REQUIRED_RPCPROXY_H_VERSION__ 475

+#endif

+

+

+#include "rpcproxy.h"

+#ifndef __RPCPROXY_H_VERSION__

+#error this stub requires an updated version of <rpcproxy.h>

+#endif /* __RPCPROXY_H_VERSION__ */

+

+

+#include "ISimpleDOMText.h"

+

+#define TYPE_FORMAT_STRING_SIZE   47                                

+#define PROC_FORMAT_STRING_SIZE   247                               

+#define EXPR_FORMAT_STRING_SIZE   1                                 

+#define TRANSMIT_AS_TABLE_SIZE    0            

+#define WIRE_MARSHAL_TABLE_SIZE   1            

+

+typedef struct _ISimpleDOMText_MIDL_TYPE_FORMAT_STRING

+    {

+    short          Pad;

+    unsigned char  Format[ TYPE_FORMAT_STRING_SIZE ];

+    } ISimpleDOMText_MIDL_TYPE_FORMAT_STRING;

+

+typedef struct _ISimpleDOMText_MIDL_PROC_FORMAT_STRING

+    {

+    short          Pad;

+    unsigned char  Format[ PROC_FORMAT_STRING_SIZE ];

+    } ISimpleDOMText_MIDL_PROC_FORMAT_STRING;

+

+typedef struct _ISimpleDOMText_MIDL_EXPR_FORMAT_STRING

+    {

+    long          Pad;

+    unsigned char  Format[ EXPR_FORMAT_STRING_SIZE ];

+    } ISimpleDOMText_MIDL_EXPR_FORMAT_STRING;

+

+

+static const RPC_SYNTAX_IDENTIFIER  _RpcTransferSyntax = 

+{{0x8A885D04,0x1CEB,0x11C9,{0x9F,0xE8,0x08,0x00,0x2B,0x10,0x48,0x60}},{2,0}};

+

+

+extern const ISimpleDOMText_MIDL_TYPE_FORMAT_STRING ISimpleDOMText__MIDL_TypeFormatString;

+extern const ISimpleDOMText_MIDL_PROC_FORMAT_STRING ISimpleDOMText__MIDL_ProcFormatString;

+extern const ISimpleDOMText_MIDL_EXPR_FORMAT_STRING ISimpleDOMText__MIDL_ExprFormatString;

+

+

+extern const MIDL_STUB_DESC Object_StubDesc;

+

+

+extern const MIDL_SERVER_INFO ISimpleDOMText_ServerInfo;

+extern const MIDL_STUBLESS_PROXY_INFO ISimpleDOMText_ProxyInfo;

+

+

+extern const USER_MARSHAL_ROUTINE_QUADRUPLE UserMarshalRoutines[ WIRE_MARSHAL_TABLE_SIZE ];

+

+#if !defined(__RPC_WIN32__)

+#error  Invalid build platform for this stub.

+#endif

+

+#if !(TARGET_IS_NT50_OR_LATER)

+#error You need Windows 2000 or later to run this stub because it uses these features:

+#error   /robust command line switch.

+#error However, your C/C++ compilation flags indicate you intend to run this app on earlier systems.

+#error This app will fail with the RPC_X_WRONG_STUB_VERSION error.

+#endif

+

+

+static const ISimpleDOMText_MIDL_PROC_FORMAT_STRING ISimpleDOMText__MIDL_ProcFormatString =

+    {

+        0,

+        {

+

+	/* Procedure get_domText */

+

+			0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/*  2 */	NdrFcLong( 0x0 ),	/* 0 */

+/*  6 */	NdrFcShort( 0x3 ),	/* 3 */

+/*  8 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 10 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 12 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 14 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 16 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 18 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 20 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 22 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter domText */

+

+/* 24 */	NdrFcShort( 0x2113 ),	/* Flags:  must size, must free, out, simple ref, srv alloc size=8 */

+/* 26 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 28 */	NdrFcShort( 0x20 ),	/* Type Offset=32 */

+

+	/* Return value */

+

+/* 30 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 32 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 34 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_clippedSubstringBounds */

+

+/* 36 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 38 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 42 */	NdrFcShort( 0x4 ),	/* 4 */

+/* 44 */	NdrFcShort( 0x20 ),	/* x86 Stack size/offset = 32 */

+/* 46 */	NdrFcShort( 0x10 ),	/* 16 */

+/* 48 */	NdrFcShort( 0x78 ),	/* 120 */

+/* 50 */	0x44,		/* Oi2 Flags:  has return, has ext, */

+			0x7,		/* 7 */

+/* 52 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 54 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 56 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 58 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter startIndex */

+

+/* 60 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 62 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 64 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter endIndex */

+

+/* 66 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 68 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 70 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter x */

+

+/* 72 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 74 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 76 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter y */

+

+/* 78 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 80 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 82 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter width */

+

+/* 84 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 86 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 88 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter height */

+

+/* 90 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 92 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 94 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 96 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 98 */	NdrFcShort( 0x1c ),	/* x86 Stack size/offset = 28 */

+/* 100 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_unclippedSubstringBounds */

+

+/* 102 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 104 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 108 */	NdrFcShort( 0x5 ),	/* 5 */

+/* 110 */	NdrFcShort( 0x20 ),	/* x86 Stack size/offset = 32 */

+/* 112 */	NdrFcShort( 0x10 ),	/* 16 */

+/* 114 */	NdrFcShort( 0x78 ),	/* 120 */

+/* 116 */	0x44,		/* Oi2 Flags:  has return, has ext, */

+			0x7,		/* 7 */

+/* 118 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 120 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 122 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 124 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter startIndex */

+

+/* 126 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 128 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 130 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter endIndex */

+

+/* 132 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 134 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 136 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter x */

+

+/* 138 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 140 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 142 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter y */

+

+/* 144 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 146 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 148 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter width */

+

+/* 150 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 152 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */

+/* 154 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter height */

+

+/* 156 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */

+/* 158 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */

+/* 160 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 162 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 164 */	NdrFcShort( 0x1c ),	/* x86 Stack size/offset = 28 */

+/* 166 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure scrollToSubstring */

+

+/* 168 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 170 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 174 */	NdrFcShort( 0x6 ),	/* 6 */

+/* 176 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */

+/* 178 */	NdrFcShort( 0x10 ),	/* 16 */

+/* 180 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 182 */	0x44,		/* Oi2 Flags:  has return, has ext, */

+			0x3,		/* 3 */

+/* 184 */	0x8,		/* 8 */

+			0x1,		/* Ext Flags:  new corr desc, */

+/* 186 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 188 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 190 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter startIndex */

+

+/* 192 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 194 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 196 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Parameter endIndex */

+

+/* 198 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */

+/* 200 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 202 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Return value */

+

+/* 204 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 206 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 208 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+	/* Procedure get_fontFamily */

+

+/* 210 */	0x33,		/* FC_AUTO_HANDLE */

+			0x6c,		/* Old Flags:  object, Oi2 */

+/* 212 */	NdrFcLong( 0x0 ),	/* 0 */

+/* 216 */	NdrFcShort( 0x7 ),	/* 7 */

+/* 218 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */

+/* 220 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 222 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 224 */	0x45,		/* Oi2 Flags:  srv must size, has return, has ext, */

+			0x2,		/* 2 */

+/* 226 */	0x8,		/* 8 */

+			0x3,		/* Ext Flags:  new corr desc, clt corr check, */

+/* 228 */	NdrFcShort( 0x1 ),	/* 1 */

+/* 230 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 232 */	NdrFcShort( 0x0 ),	/* 0 */

+

+	/* Parameter fontFamily */

+

+/* 234 */	NdrFcShort( 0x2113 ),	/* Flags:  must size, must free, out, simple ref, srv alloc size=8 */

+/* 236 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */

+/* 238 */	NdrFcShort( 0x20 ),	/* Type Offset=32 */

+

+	/* Return value */

+

+/* 240 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */

+/* 242 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */

+/* 244 */	0x8,		/* FC_LONG */

+			0x0,		/* 0 */

+

+			0x0

+        }

+    };

+

+static const ISimpleDOMText_MIDL_TYPE_FORMAT_STRING ISimpleDOMText__MIDL_TypeFormatString =

+    {

+        0,

+        {

+			NdrFcShort( 0x0 ),	/* 0 */

+/*  2 */	

+			0x11, 0x4,	/* FC_RP [alloced_on_stack] */

+/*  4 */	NdrFcShort( 0x1c ),	/* Offset= 28 (32) */

+/*  6 */	

+			0x13, 0x0,	/* FC_OP */

+/*  8 */	NdrFcShort( 0xe ),	/* Offset= 14 (22) */

+/* 10 */	

+			0x1b,		/* FC_CARRAY */

+			0x1,		/* 1 */

+/* 12 */	NdrFcShort( 0x2 ),	/* 2 */

+/* 14 */	0x9,		/* Corr desc: FC_ULONG */

+			0x0,		/*  */

+/* 16 */	NdrFcShort( 0xfffc ),	/* -4 */

+/* 18 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */

+/* 20 */	0x6,		/* FC_SHORT */

+			0x5b,		/* FC_END */

+/* 22 */	

+			0x17,		/* FC_CSTRUCT */

+			0x3,		/* 3 */

+/* 24 */	NdrFcShort( 0x8 ),	/* 8 */

+/* 26 */	NdrFcShort( 0xfff0 ),	/* Offset= -16 (10) */

+/* 28 */	0x8,		/* FC_LONG */

+			0x8,		/* FC_LONG */

+/* 30 */	0x5c,		/* FC_PAD */

+			0x5b,		/* FC_END */

+/* 32 */	0xb4,		/* FC_USER_MARSHAL */

+			0x83,		/* 131 */

+/* 34 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 36 */	NdrFcShort( 0x4 ),	/* 4 */

+/* 38 */	NdrFcShort( 0x0 ),	/* 0 */

+/* 40 */	NdrFcShort( 0xffde ),	/* Offset= -34 (6) */

+/* 42 */	

+			0x11, 0xc,	/* FC_RP [alloced_on_stack] [simple_pointer] */

+/* 44 */	0x8,		/* FC_LONG */

+			0x5c,		/* FC_PAD */

+

+			0x0

+        }

+    };

+

+static const USER_MARSHAL_ROUTINE_QUADRUPLE UserMarshalRoutines[ WIRE_MARSHAL_TABLE_SIZE ] = 

+        {

+            

+            {

+            BSTR_UserSize

+            ,BSTR_UserMarshal

+            ,BSTR_UserUnmarshal

+            ,BSTR_UserFree

+            }

+

+        };

+

+

+

+/* Standard interface: __MIDL_itf_ISimpleDOMText_0000_0000, ver. 0.0,

+   GUID={0x00000000,0x0000,0x0000,{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}} */

+

+

+/* Object interface: IUnknown, ver. 0.0,

+   GUID={0x00000000,0x0000,0x0000,{0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46}} */

+

+

+/* Object interface: ISimpleDOMText, ver. 0.0,

+   GUID={0x4e747be5,0x2052,0x4265,{0x8a,0xf0,0x8e,0xca,0xd7,0xaa,0xd1,0xc0}} */

+

+#pragma code_seg(".orpc")

+static const unsigned short ISimpleDOMText_FormatStringOffsetTable[] =

+    {

+    0,

+    36,

+    102,

+    168,

+    210

+    };

+

+static const MIDL_STUBLESS_PROXY_INFO ISimpleDOMText_ProxyInfo =

+    {

+    &Object_StubDesc,

+    ISimpleDOMText__MIDL_ProcFormatString.Format,

+    &ISimpleDOMText_FormatStringOffsetTable[-3],

+    0,

+    0,

+    0

+    };

+

+

+static const MIDL_SERVER_INFO ISimpleDOMText_ServerInfo = 

+    {

+    &Object_StubDesc,

+    0,

+    ISimpleDOMText__MIDL_ProcFormatString.Format,

+    &ISimpleDOMText_FormatStringOffsetTable[-3],

+    0,

+    0,

+    0,

+    0};

+CINTERFACE_PROXY_VTABLE(8) _ISimpleDOMTextProxyVtbl = 

+{

+    &ISimpleDOMText_ProxyInfo,

+    &IID_ISimpleDOMText,

+    IUnknown_QueryInterface_Proxy,

+    IUnknown_AddRef_Proxy,

+    IUnknown_Release_Proxy ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMText::get_domText */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMText::get_clippedSubstringBounds */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMText::get_unclippedSubstringBounds */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMText::scrollToSubstring */ ,

+    (void *) (INT_PTR) -1 /* ISimpleDOMText::get_fontFamily */

+};

+

+const CInterfaceStubVtbl _ISimpleDOMTextStubVtbl =

+{

+    &IID_ISimpleDOMText,

+    &ISimpleDOMText_ServerInfo,

+    8,

+    0, /* pure interpreted */

+    CStdStubBuffer_METHODS

+};

+

+static const MIDL_STUB_DESC Object_StubDesc = 

+    {

+    0,

+    NdrOleAllocate,

+    NdrOleFree,

+    0,

+    0,

+    0,

+    0,

+    0,

+    ISimpleDOMText__MIDL_TypeFormatString.Format,

+    1, /* -error bounds_check flag */

+    0x50002, /* Ndr library version */

+    0,

+    0x801026e, /* MIDL Version 8.1.622 */

+    0,

+    UserMarshalRoutines,

+    0,  /* notify & notify_flag routine table */

+    0x1, /* MIDL flag */

+    0, /* cs routines */

+    0,   /* proxy/server info */

+    0

+    };

+

+const CInterfaceProxyVtbl * const _ISimpleDOMText_ProxyVtblList[] = 

+{

+    ( CInterfaceProxyVtbl *) &_ISimpleDOMTextProxyVtbl,

+    0

+};

+

+const CInterfaceStubVtbl * const _ISimpleDOMText_StubVtblList[] = 

+{

+    ( CInterfaceStubVtbl *) &_ISimpleDOMTextStubVtbl,

+    0

+};

+

+PCInterfaceName const _ISimpleDOMText_InterfaceNamesList[] = 

+{

+    "ISimpleDOMText",

+    0

+};

+

+

+#define _ISimpleDOMText_CHECK_IID(n)	IID_GENERIC_CHECK_IID( _ISimpleDOMText, pIID, n)

+

+int __stdcall _ISimpleDOMText_IID_Lookup( const IID * pIID, int * pIndex )

+{

+    

+    if(!_ISimpleDOMText_CHECK_IID(0))

+        {

+        *pIndex = 0;

+        return 1;

+        }

+

+    return 0;

+}

+

+const ExtendedProxyFileInfo ISimpleDOMText_ProxyFileInfo = 

+{

+    (PCInterfaceProxyVtblList *) & _ISimpleDOMText_ProxyVtblList,

+    (PCInterfaceStubVtblList *) & _ISimpleDOMText_StubVtblList,

+    (const PCInterfaceName * ) & _ISimpleDOMText_InterfaceNamesList,

+    0, /* no delegation */

+    & _ISimpleDOMText_IID_Lookup, 

+    1,

+    2,

+    0, /* table of [async_uuid] interfaces */

+    0, /* Filler1 */

+    0, /* Filler2 */

+    0  /* Filler3 */

+};

+#if _MSC_VER >= 1200

+#pragma warning(pop)

+#endif

+

+

+#endif /* !defined(_M_IA64) && !defined(_M_AMD64) && !defined(_ARM_) */

+


diff --git a/tools/battor_agent/battor_agent.cc b/tools/battor_agent/battor_agent.cc
index 81dd0d3..0ad10b82 100644
--- a/tools/battor_agent/battor_agent.cc
+++ b/tools/battor_agent/battor_agent.cc

@@ -29,9 +29,6 @@
 // The number of seconds allowed for a control message before timing out.
 const uint8_t kBattOrControlMessageTimeoutSeconds = 2;
 
-// The number of seconds allowed for connection to open before timing out.
-const uint8_t kBattOrConnectionTimeoutSeconds = 10;
-
 // Returns true if the specified vector of bytes decodes to a message that is an
 // ack for the specified control message type.
 bool IsAckOfControlCommand(BattOrMessageType message_type,
@@ -161,15 +158,10 @@
 void BattOrAgent::BeginConnect() {
   DCHECK(thread_checker_.CalledOnValidThread());
 
-  SetActionTimeout(kBattOrConnectionTimeoutSeconds);
-
   connection_->Open();
 }
 
 void BattOrAgent::OnConnectionOpened(bool success) {
-  // Cancel timeout because the connection was opened in time.
-  timeout_callback_.Cancel();
-
   if (!success) {
     CompleteCommand(BATTOR_ERROR_CONNECTION_FAILED);
     return;

diff --git a/tools/battor_agent/battor_agent_bin.cc b/tools/battor_agent/battor_agent_bin.cc
index f839a16..487799ec 100644
--- a/tools/battor_agent/battor_agent_bin.cc
+++ b/tools/battor_agent/battor_agent_bin.cc

@@ -70,6 +70,7 @@
     "\n"
     "Switches: \n"
     "  --battor-path=<path> Uses the specified BattOr path.\n"
+    "  --interactive Enables interactive power profiling."
     "\n"
     "Once in the shell, you can issue the following commands:\n"
     "\n"
@@ -82,6 +83,10 @@
     "  Help\n"
     "\n";
 
+// The command line switch used to enable interactive mode where starting and
+// stopping is easily toggled.
+const char kInteractiveSwitch[] = "interactive";
+
 void PrintSupportsExplicitClockSync() {
   std::cout << BattOrAgent::SupportsExplicitClockSync() << endl;
 }
@@ -133,6 +138,13 @@
 
     SetUp(path);
 
+    if (base::CommandLine::ForCurrentProcess()->HasSwitch(kInteractiveSwitch)) {
+      interactive_ = true;
+      std::cout << "Type <Enter> to toggle tracing, type Exit or Ctrl+C "
+                   "to quit, or Help for help."
+                << endl;
+    }
+
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE,
         base::Bind(&BattOrAgentBin::RunNextCommand, base::Unretained(this)));
@@ -178,6 +190,14 @@
     std::string cmd;
     std::getline(std::cin, cmd);
 
+    if (interactive_) {
+      if (cmd == "") {
+        cmd = is_tracing_ ? "StopTracing" : "StartTracing";
+        std::cout << cmd << endl;
+        is_tracing_ = !is_tracing_;
+      }
+    }
+
     if (cmd == "StartTracing") {
       StartTracing();
     } else if (cmd.find("StopTracing") != std::string::npos) {
@@ -196,6 +216,9 @@
           tokens.size() == 2 ? tokens[1] : std::string();
 
       StopTracing(trace_output_file);
+      if (interactive_) {
+        PostRunNextCommand();
+      }
     } else if (cmd == "SupportsExplicitClockSync") {
       PrintSupportsExplicitClockSync();
       PostRunNextCommand();
@@ -270,7 +293,12 @@
                              BattOrError error) override {
     if (error == BATTOR_ERROR_NONE) {
       if (trace_output_file_.empty()) {
-        std::cout << trace;
+        if (interactive_) {
+          // Printing of summary statistics will happen here.
+          std::cout << trace.size() << " bytes of output collected." << endl;
+        } else {
+          std::cout << trace;
+        }
       } else {
         std::ofstream trace_stream(trace_output_file_);
         if (!trace_stream.is_open()) {
@@ -285,8 +313,10 @@
       HandleError(error);
     }
 
-    ui_thread_message_loop_.task_runner()->PostTask(
-        FROM_HERE, ui_thread_run_loop_.QuitClosure());
+    if (!interactive_) {
+      ui_thread_message_loop_.task_runner()->PostTask(
+          FROM_HERE, ui_thread_run_loop_.QuitClosure());
+    }
   }
 
   void RecordClockSyncMarker(const std::string& marker) {
@@ -336,6 +366,11 @@
   std::unique_ptr<BattOrAgent> agent_;
 
   std::string trace_output_file_;
+
+  // When true user can Start/Stop tracing by typing Enter.
+  bool interactive_ = false;
+  // Toggle to support alternating starting/stopping tracing.
+  bool is_tracing_ = false;
 };
 
 }  // namespace battor

diff --git a/tools/battor_agent/battor_connection_impl.cc b/tools/battor_agent/battor_connection_impl.cc
index f1ced22..aa71ffc 100644
--- a/tools/battor_agent/battor_connection_impl.cc
+++ b/tools/battor_agent/battor_connection_impl.cc

@@ -41,6 +41,8 @@
 const bool kBattOrHasCtsFlowControl = true;
 // The maximum BattOr message is 50kB long.
 const size_t kMaxMessageSizeBytes = 50000;
+// The number of seconds allowed for the connection to open before timing out.
+const uint8_t kConnectTimeoutSeconds = 10;
 const size_t kFlushBufferSize = 50000;
 // The length of time that must pass without receiving any bytes in order for a
 // flush to be considered complete.
@@ -102,6 +104,7 @@
   options.has_cts_flow_control = kBattOrHasCtsFlowControl;
 
   LogSerial("Opening serial connection.");
+  SetTimeout(base::TimeDelta::FromSeconds(kConnectTimeoutSeconds));
   io_handler_->Open(
       path_, options,
       base::BindOnce(&BattOrConnectionImpl::OnOpened, AsWeakPtr()));
@@ -110,6 +113,7 @@
 void BattOrConnectionImpl::OnOpened(bool success) {
   LogSerial(StringPrintf("Serial connection open finished with success: %d.",
                          success));
+  timeout_callback_.Cancel();
 
   if (!success) {
     Close();
@@ -316,21 +320,20 @@
       pending_read_buffer_, static_cast<uint32_t>(kFlushBufferSize),
       base::BindOnce(&BattOrConnectionImpl::OnBytesReadForFlush,
                      base::Unretained(this))));
-  SetFlushReadTimeout();
+  SetTimeout(base::TimeDelta::FromMilliseconds(kFlushQuietPeriodThresholdMs));
 }
 
-void BattOrConnectionImpl::SetFlushReadTimeout() {
-  flush_timeout_callback_.Reset(
+void BattOrConnectionImpl::SetTimeout(base::TimeDelta timeout) {
+  timeout_callback_.Reset(
       base::Bind(&BattOrConnectionImpl::CancelReadMessage, AsWeakPtr()));
   base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, flush_timeout_callback_.callback(),
-      base::TimeDelta::FromMilliseconds(kFlushQuietPeriodThresholdMs));
+      FROM_HERE, timeout_callback_.callback(), timeout);
 }
 
 void BattOrConnectionImpl::OnBytesReadForFlush(
     int bytes_read,
     device::mojom::SerialReceiveError error) {
-  flush_timeout_callback_.Cancel();
+  timeout_callback_.Cancel();
 
   if (error != device::mojom::SerialReceiveError::NONE &&
       error != device::mojom::SerialReceiveError::TIMEOUT) {

diff --git a/tools/battor_agent/battor_connection_impl.h b/tools/battor_agent/battor_connection_impl.h
index 46a132fa..3e1cf40 100644
--- a/tools/battor_agent/battor_connection_impl.h
+++ b/tools/battor_agent/battor_connection_impl.h

@@ -83,7 +83,7 @@
   void BeginReadBytesForFlush();
   void OnBytesReadForFlush(int bytes_read,
                            device::mojom::SerialReceiveError error);
-  void SetFlushReadTimeout();
+  void SetTimeout(base::TimeDelta timeout);
 
   // Pulls off the next complete message from already_read_buffer_, returning
   // its type and contents through out parameters and any error that occurred
@@ -123,8 +123,8 @@
   // connection in order for Flush() to be considered complete.
   base::TimeTicks flush_quiet_period_start_;
 
-  // The timeout that will trigger a timeout at the end of a flush quiet period.
-  base::CancelableClosure flush_timeout_callback_;
+  // The timeout for the current action.
+  base::CancelableClosure timeout_callback_;
 
   // Threads needed for serial communication.
   scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner_;

diff --git a/tools/determinism/deterministic_build_whitelist.pyl b/tools/determinism/deterministic_build_whitelist.pyl
index 4d7114a..8a4c4e3 100644
--- a/tools/determinism/deterministic_build_whitelist.pyl
+++ b/tools/determinism/deterministic_build_whitelist.pyl

@@ -21,6 +21,7 @@
 
   # https://crbug.com/330263
   'linux': [
+    'ppapi_nacl_tests_pnacl_newlib_x64.nexe',
   ],
 
   # https://crbug.com/330262

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 633106b..8abebb9 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -1167,6 +1167,12 @@
   <int value="3" label="Scrolled With Mouse"/>
 </enum>
 
+<enum name="AppListPlayStoreQueryState">
+  <int value="0" label="SUCCESS"/>
+  <int value="1" label="CANCELED"/>
+  <int value="2" label="ERROR"/>
+</enum>
+
 <enum name="AppListSearchResult">
   <int value="0" label="OMNIBOX"/>
   <int value="1" label="APP"/>
@@ -16261,6 +16267,7 @@
   <int value="2142" label="WebkitBoxLineClampOneChildIsLayoutBlockFlowInline"/>
   <int value="2143" label="WebkitBoxLineClampManyChildren"/>
   <int value="2144" label="WebkitBoxLineClampDoesSomething"/>
+  <int value="2145" label="FeaturePolicyAllowAttributeDeprecatedSyntax"/>
 </enum>
 
 <enum name="FeedbackSource">
@@ -23451,6 +23458,7 @@
   <int value="-741806604" label="DownloadsUi:disabled"/>
   <int value="-723224470" label="enable-password-force-saving:enabled"/>
   <int value="-722474177" label="browser-side-navigation:disabled"/>
+  <int value="-718626298" label="SysInternals:enabled"/>
   <int value="-716953514" label="disable-password-separated-signin-flow"/>
   <int value="-715733307" label="force-effective-connection-type"/>
   <int value="-714712077" label="ClickToOpenPDFPlaceholder:disabled"/>
@@ -24111,6 +24119,7 @@
   <int value="1363136936" label="VrCustomTabBrowsing:enabled"/>
   <int value="1367529437" label="NTPAssetDownloadSuggestions:enabled"/>
   <int value="1367671275" label="enable-proximity-auth-proximity-detection"/>
+  <int value="1369449914" label="SysInternals:disabled"/>
   <int value="1371092708" label="disable-desktop-capture-picker-old-ui"/>
   <int value="1371907429" label="enable-wallet-card-import"/>
   <int value="1372199493" label="windows10-custom-titlebar"/>

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 9e44e285..ae4992d4 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -1719,6 +1719,12 @@
   </summary>
 </histogram>
 
+<histogram name="Apps.AppListPlayStoreQueryState"
+    enum="AppListPlayStoreQueryState">
+  <owner>hejq@chromium.org</owner>
+  <summary>The state of a Play Store app search request.</summary>
+</histogram>
+
 <histogram name="Apps.AppListSearchCommenced" units="searches">
   <owner>tapted@chromium.org</owner>
   <summary>
@@ -42546,6 +42552,9 @@
 </histogram>
 
 <histogram name="Net.RequestTime2">
+  <obsolete>
+    Unused, so removed from Chromium as of 2017/8/31.
+  </obsolete>
   <owner>rdsmith@chromium.org</owner>
   <summary>
     The amount of time between request initiation and request completion for
@@ -42554,6 +42563,9 @@
 </histogram>
 
 <histogram name="Net.RequestTime2.ErrAborted.HttpScheme" units="ms">
+  <obsolete>
+    Unused, so removed from Chromium as of 2017/8/31.
+  </obsolete>
   <owner>csharrison@chromium.org</owner>
   <summary>
     The amount of time between request initiation and request completion for
@@ -42562,6 +42574,9 @@
 </histogram>
 
 <histogram name="Net.RequestTime2.ErrAborted.NetworkContent" units="ms">
+  <obsolete>
+    Unused, so removed from Chromium as of 2017/8/31.
+  </obsolete>
   <owner>csharrison@chromium.org</owner>
   <summary>
     The amount of time between request initiation and request completion for
@@ -42570,6 +42585,9 @@
 </histogram>
 
 <histogram name="Net.RequestTime2.ErrAborted.NoBytesRead" units="ms">
+  <obsolete>
+    Unused, so removed from Chromium as of 2017/8/31.
+  </obsolete>
   <owner>csharrison@chromium.org</owner>
   <summary>
     The amount of time between request initiation and request completion for
@@ -42580,6 +42598,9 @@
 
 <histogram name="Net.RequestTime2.ErrAborted.NoNetworkContent.CachedContent"
     units="ms">
+  <obsolete>
+    Unused, so removed from Chromium as of 2017/8/31.
+  </obsolete>
   <owner>csharrison@chromium.org</owner>
   <summary>
     The amount of time between request initiation and request completion for
@@ -42589,6 +42610,9 @@
 </histogram>
 
 <histogram name="Net.RequestTime2.ErrAborted.NonHttpScheme" units="ms">
+  <obsolete>
+    Unused, so removed from Chromium as of 2017/8/31.
+  </obsolete>
   <owner>csharrison@chromium.org</owner>
   <summary>
     The amount of time between request initiation and request completion for

diff --git a/tools/perf/benchmark.csv b/tools/perf/benchmark.csv
index ed55f0d..c9d0265 100644
--- a/tools/perf/benchmark.csv
+++ b/tools/perf/benchmark.csv

@@ -15,7 +15,6 @@
 blink_perf.parser,"jbroman@chromium.org, yukishiino@chromium.org, haraken@chromium.org",
 blink_perf.shadow_dom,hayato@chromium.org,
 blink_perf.svg,"kouhei@chromium.org, fs@opera.com",
-blob_storage.blob_storage,,
 cc_perftests,enne@chromium.org,
 dromaeo.domcoreattr,"jbroman@chromium.org, yukishiino@chromium.org, haraken@chromium.org",
 dromaeo.domcoremodify,"jbroman@chromium.org, yukishiino@chromium.org, haraken@chromium.org",

diff --git a/tools/perf/benchmarks/blob_storage.py b/tools/perf/benchmarks/blob_storage.py
deleted file mode 100644
index 0575202..0000000
--- a/tools/perf/benchmarks/blob_storage.py
+++ /dev/null

@@ -1,65 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-from core import perf_benchmark
-
-from telemetry import story
-from telemetry.timeline import chrome_trace_category_filter
-from telemetry.web_perf import timeline_based_measurement
-
-import page_sets
-
-
-BLOB_CATEGORY = 'Blob'
-TIMELINE_REQUIRED_CATEGORY = 'blink.console'
-
-
-class BlobStorage(perf_benchmark.PerfBenchmark):
-  """Timeline based measurement benchmark for Blob Storage."""
-
-  page_set = page_sets.BlobWorkshopPageSet
-
-  def CreateCoreTimelineBasedMeasurementOptions(self):
-    cat_filter = chrome_trace_category_filter.ChromeTraceCategoryFilter()
-    cat_filter.AddIncludedCategory(BLOB_CATEGORY)
-    cat_filter.AddIncludedCategory(TIMELINE_REQUIRED_CATEGORY)
-
-    return timeline_based_measurement.Options(
-        overhead_level=cat_filter)
-
-  # Necessary until crbug.com/544306 is finished.
-  def SetExtraBrowserOptions(self, options):
-    options.AppendExtraBrowserArgs(
-        ['--enable-experimental-web-platform-features'])
-
-  @classmethod
-  def Name(cls):
-    return 'blob_storage.blob_storage'
-
-  @classmethod
-  def ValueCanBeAddedPredicate(cls, value, is_first_result):
-    if ('blob-writes' not in value.name and
-        'blob-reads' not in value.name):
-      return False
-    return value.values != None
-
-
-  def GetExpectations(self):
-    class StoryExpectations(story.expectations.StoryExpectations):
-      def SetExpectations(self):
-        self.DisableStory('blob-mass-create-80MBx5', [story.expectations.ALL],
-                          'crbug.com/510815')
-        self.DisableStory('blob-create-read-10MBx30',
-                          [story.expectations.ANDROID_ONE], 'crbug.com/739214')
-        self.DisableStory('blob-create-read-80MBx5',
-                          [story.expectations.ALL_ANDROID], 'crbug.com/739214')
-        self.DisableStory('blob-mass-create-10MBx30',
-                          [story.expectations.ANDROID_ONE,
-                           story.expectations.ANDROID_WEBVIEW],
-                          'crbug.com/739214')
-        self.DisableStory('blob-mass-create-1MBx200',
-                          [story.expectations.ANDROID_ONE], 'crbug.com/739214')
-        self.DisableStory('blob-mass-create-150KBx200',
-                          [story.expectations.ANDROID_ONE], 'crbug.com/739214')
-    return StoryExpectations()

diff --git a/tools/perf/benchmarks/v8_browsing.py b/tools/perf/benchmarks/v8_browsing.py
index 969bb2f..d9e52078 100644
--- a/tools/perf/benchmarks/v8_browsing.py
+++ b/tools/perf/benchmarks/v8_browsing.py

@@ -173,6 +173,10 @@
   PLATFORM = 'desktop'
   SUPPORTED_PLATFORMS = [story.expectations.ALL_DESKTOP]
 
+  def SetExtraBrowserOptions(self, options):
+    options.AppendExtraBrowserArgs(
+      '--enable-blink-features=BlinkRuntimeCallStats')
+
   @classmethod
   def Name(cls):
     return 'v8.runtimestats.browsing_desktop'

diff --git a/tools/perf/page_sets/blob/blob-workshop.html b/tools/perf/page_sets/blob/blob-workshop.html
deleted file mode 100644
index 5a631f0..0000000
--- a/tools/perf/page_sets/blob/blob-workshop.html
+++ /dev/null

@@ -1,174 +0,0 @@
-<script>
-var blobs = [];
-var bytes = 0;
-var timeStart;
-var timeEnd;
-var doneReading = false;
-var errors = [];
-var disableUI = false;
-
-function recordError(error) {
-  console.log(error);
-  errors.push(error);
-}
-
-function updateStats() {
-  if (disableUI) return;
-  var num_blobs = document.getElementById('num_blobs');
-  var total_bytes = document.getElementById('total_bytes');
-  var time = document.getElementById('time');
-  num_blobs.innerHTML = '' + blobs.length;
-  total_bytes.innerHTML = '' + bytes;
-  time.innerHTML = '' + (timeEnd - timeStart);
-}
-
-function createAndRead(size) {
-  doneReading = false;
-  errors = [];
-  var reader = new FileReader();
-  var currentBlob = 0;
-  var totalSize = 0;
-  var error = document.getElementById('error');
-  var numRead = 0;
-
-  var blob = new Blob([new Uint8Array(size)], {type: 'application/octet-string'});
-
-  reader.onloadend = function(e) {
-    if (reader.error) {
-      recordError('Error when reading blob: ' + reader.error);
-      doneReading = true;
-      return;
-    }
-    if (reader.result.byteLength != size) {
-      recordError("Sizes don't match");
-    }
-    doneReading = true;
-  }
-  reader.readAsArrayBuffer(blob);
-}
-
-function createBlob(size) {
-  timeStart = performance.now();
-  var blob = new Blob([new Uint8Array(size)], {type: 'application/octet-string'});
-  timeEnd = performance.now();
-  blobs.push(blob);
-  bytes += size;
-  updateStats();
-}
-
-function garbageCollect() {
-  if (typeof(Blob.prototype.close) !== "undefined") {
-    for (var blob of blobs) {
-      blob.close();
-    }
-  }
-  blobs = [];
-  bytes = 0;
-  updateStats();
-}
-
-function addCustom() {
-  var custom_input = document.getElementById('custom_input');
-  var custom_bytes = custom_input.value;
-  createBlob(custom_bytes * 1);
-}
-
-function readBlobsSerially() {
-  doneReading = false;
-  errors = [];
-  if (blobs.length == 0) {
-    return;
-  }
-  timeStart = performance.now();
-  var reader = new FileReader();
-  var currentBlob = 0;
-  var totalSize = 0;
-  var error = document.getElementById('error');
-  var numRead = 0;
-  reader.onloadend = function(e) {
-    if (reader.error) {
-      if (!disableUI)
-        error.innerHTML += '<br/>Reader error:<br/>' + reader.error.message;
-      recordError('Error when reading blob ' + currentBlob + ': ' + reader.error);
-      doneReading = true;
-      return;
-    }
-    totalSize += reader.result.byteLength;
-    currentBlob++;
-    if (currentBlob < blobs.length) {
-      reader.readAsArrayBuffer(blobs[currentBlob]);
-    } else {
-      timeEnd = performance.now();
-      // we're done reading
-      if (totalSize != bytes) {
-        recordError("Sizes don't match");
-        if (!disableUI)
-          error.innerHTML += '<br/>Sizes don\'t match: ' + totalSize + ' vs ' + bytes;
-      }
-      doneReading = true;
-      updateStats();
-    }
-  }
-  reader.readAsArrayBuffer(blobs[currentBlob]);
-}
-function readBlobsInParallel() {
-  doneReading = false;
-  errors = [];
-  if (blobs.length == 0) {
-    return;
-  }
-  timeStart = performance.now();
-  var currentBlob = 0;
-  var totalSize = 0;
-  var error = document.getElementById('error');
-  var numRead = 0;
-  for (; currentBlob < blobs.length; currentBlob++) {
-    var genReader = function(index) {
-      var reader = new FileReader();
-      reader.onloadend = function(e) {
-        if (reader.error) {
-          if (!disableUI)
-            error.innerHTML += '<br/>Reader error:<br/>' + reader.error.message;
-          recordError('Error when reading blob ' + index + ': ' + reader.error);
-          doneReading = true;
-          return;
-        }
-        totalSize += reader.result.byteLength;
-        numRead++;
-        if (numRead >= blobs.length) {
-          timeEnd = performance.now();
-          // we're done reading
-          if (totalSize != bytes) {
-            recordError("Sizes don't match");
-            if (!disableUI)
-              error.innerHTML += '<br/>Sizes don\'t match: ' + totalSize + ' vs ' + bytes;
-          }
-          doneReading = true;
-          updateStats();
-        }
-      }
-      return reader;
-    }
-    genReader(currentBlob).readAsArrayBuffer(blobs[currentBlob]);
-  }
-}
-</script>
-<div>Number of blobs: <span id="num_blobs">0</span>, total memory size: <span id="total_bytes">0</span> bytes.</div>
-<input type="button" id="custom_input_submit" value="Add Blob with Size" onclick="addCustom();"/>
-<input type="text" inputmode="numeric" id="custom_input" value=""/><br/>
-
-Shorcut buttons for person:
-<input type="button" value="2 bytes" onclick="createBlob(2);" />
-<input type="button" value="1 kb" onclick="createBlob(1024);" />
-<input type="button" value="16 kb" onclick="createBlob(16*1024);" />
-<input type="button" value="1 mb" onclick="createBlob(1024 * 1024);" />
-<input type="button" value="40 mb" onclick="createBlob(40 * 1024 * 1024);" />
-<input type="button" value="400 mb" onclick="createBlob(400 * 1024 * 1024);" />
-
-<input type="button" id="read_blobs_serial" value="Read Blobs Serially" onclick="readBlobsSerially();" />
-<input type="button" id="read_blobs_parallel" value="Read Blobs Parallel" onclick="readBlobsInParallel();" /><br/>
-<input type="button" id="garbage_collect" value="Garbage Collect Blobs" onclick="garbageCollect();" /><br/>
-Operation Time:
-<div id="time"></div>
-Errors:
-<div id="error"></div>
\ No newline at end of file

diff --git a/tools/perf/page_sets/blob_workshop.py b/tools/perf/page_sets/blob_workshop.py
deleted file mode 100644
index 39c1bbc..0000000
--- a/tools/perf/page_sets/blob_workshop.py
+++ /dev/null

@@ -1,99 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-from telemetry.page import page as page_module
-from telemetry.page import legacy_page_test
-from telemetry import story
-
-
-NUM_BLOB_MASS_CREATE_READS = 15
-
-
-class BlobCreateThenRead(page_module.Page):
-
-  def __init__(self, write_method, blob_sizes, page_set):
-    super(BlobCreateThenRead, self).__init__(
-      url='file://blob/blob-workshop.html',
-      page_set=page_set,
-      name='blob-create-read-' + write_method)
-    self._blob_sizes = blob_sizes
-
-  def RunPageInteractions(self, action_runner):
-    action_runner.ExecuteJavaScript('disableUI = true;')
-
-    for size_bytes in self._blob_sizes:
-      with action_runner.CreateInteraction('Action_CreateAndReadBlob',
-                                           repeatable=True):
-        action_runner.ExecuteJavaScript(
-            'createAndRead({{ size }});', size=size_bytes)
-        action_runner.WaitForJavaScriptCondition(
-            'doneReading === true || errors', timeout=60)
-
-    errors = action_runner.EvaluateJavaScript('errors')
-    if errors:
-      raise legacy_page_test.Failure('Errors on page: ' + ', '.join(errors))
-
-
-class BlobMassCreate(page_module.Page):
-  def __init__(self, write_method, blob_sizes, page_set):
-    super(BlobMassCreate, self).__init__(
-      url='file://blob/blob-workshop.html',
-      page_set=page_set,
-      name='blob-mass-create-' + write_method)
-    self._blob_sizes = blob_sizes
-
-  def RunPageInteractions(self, action_runner):
-    action_runner.ExecuteJavaScript('disableUI = true;')
-
-    # Add blobs
-    for size_bytes in self._blob_sizes:
-      with action_runner.CreateInteraction('Action_CreateBlob',
-                                           repeatable=True):
-        action_runner.ExecuteJavaScript(
-            'createBlob({{ size }});', size=size_bytes)
-
-    # Read blobs
-    for _ in range(0, NUM_BLOB_MASS_CREATE_READS):
-      with action_runner.CreateInteraction('Action_ReadBlobs',
-                                           repeatable=True):
-        action_runner.ExecuteJavaScript('readBlobsSerially();')
-        action_runner.WaitForJavaScriptCondition(
-            'doneReading === true || errors', timeout=60)
-    # Clean up blobs. Make sure this flag is turned on:
-    # --enable-experimental-web-platform-features
-    action_runner.ExecuteJavaScript('garbageCollect();')
-
-    errors = action_runner.EvaluateJavaScript('errors')
-    if errors:
-      raise legacy_page_test.Failure('Errors on page: ' + ', '.join(errors))
-
-
-class BlobWorkshopPageSet(story.StorySet):
-  """The BlobWorkshop page set."""
-
-  def __init__(self):
-    super(BlobWorkshopPageSet, self).__init__()
-    self.AddStory(
-        BlobMassCreate('2Bx200', [2] * 200, self))
-    self.AddStory(
-        BlobMassCreate('1KBx200', [1024] * 200, self))
-    self.AddStory(
-        BlobMassCreate('150KBx200', [150 * 1024] * 200, self))
-    self.AddStory(
-        BlobMassCreate('1MBx200', [1024 * 1024] * 200, self))
-    self.AddStory(
-        BlobMassCreate('10MBx30', [10 * 1024 * 1024] * 30, self))
-    # http://crbug.com/510815
-    self.AddStory(
-        BlobMassCreate('80MBx5', [80 * 1024 * 1024] * 5, self))
-
-    self.AddStory(BlobCreateThenRead('2Bx200', [2] * 200, self))
-    self.AddStory(BlobCreateThenRead('1KBx200', [1024] * 200, self))
-    self.AddStory(
-        BlobCreateThenRead('150KBx200', [150 * 1024 - 1] * 200, self))
-    self.AddStory(BlobCreateThenRead('1MBx200', [1024 * 1024] * 200, self))
-    self.AddStory(
-        BlobCreateThenRead('10MBx30', [10 * 1024 * 1024] * 30, self))
-    self.AddStory(
-        BlobCreateThenRead('80MBx5', [80 * 1024 * 1024] * 5, self))

diff --git a/tools/perf/page_sets/system_health/expectations.py b/tools/perf/page_sets/system_health/expectations.py
index 0ea1568e..d5c7cf5 100644
--- a/tools/perf/page_sets/system_health/expectations.py
+++ b/tools/perf/page_sets/system_health/expectations.py

@@ -143,6 +143,8 @@
                       'crbug.com/676336')
     self.DisableStory('browse:tools:maps', [expectations.ALL],
                       'crbug.com/712694')
+    self.DisableStory('browse:news:reddit', [expectations.ALL_DESKTOP],
+                      'crbug.com/759777')
     self.DisableStory('browse:tools:earth', [expectations.ALL],
                       'crbug.com/708590')
     self.DisableStory('browse:news:cnn',

diff --git a/tools/perf/unowned_benchmarks.txt b/tools/perf/unowned_benchmarks.txt
index 3d06e7e..1f7ccc90 100644
--- a/tools/perf/unowned_benchmarks.txt
+++ b/tools/perf/unowned_benchmarks.txt

@@ -1,4 +1,3 @@
-blob_storage.blob_storage
 load_library_perf_tests
 power.idle_platform
 power.steady_state

diff --git a/ui/app_list/app_list_constants.cc b/ui/app_list/app_list_constants.cc
index 6e0b28c..76fc334 100644
--- a/ui/app_list/app_list_constants.cc
+++ b/ui/app_list/app_list_constants.cc

@@ -169,7 +169,9 @@
 const int kShelfSize = 48;
 
 // Max items allowed in a folder.
-size_t kMaxFolderItems = 16;
+const size_t kMaxFolderItems = 16;
+// Max items allowed in a folder for fullscreen app list folder v1.
+const size_t kMaxFolderItemsFullscreen = 20;
 
 // Number of the top items in a folder, which are shown inside the folder icon
 // and animated when opening and closing a folder.

diff --git a/ui/app_list/app_list_constants.h b/ui/app_list/app_list_constants.h
index 4250e24..3b8f1ca9 100644
--- a/ui/app_list/app_list_constants.h
+++ b/ui/app_list/app_list_constants.h

@@ -113,7 +113,8 @@
 APP_LIST_EXPORT extern const int kPeekingAppListHeight;
 APP_LIST_EXPORT extern const int kShelfSize;
 
-APP_LIST_EXPORT extern size_t kMaxFolderItems;
+APP_LIST_EXPORT extern const size_t kMaxFolderItems;
+APP_LIST_EXPORT extern const size_t kMaxFolderItemsFullscreen;
 APP_LIST_EXPORT extern const size_t kNumFolderTopItems;
 APP_LIST_EXPORT extern const size_t kMaxFolderNameChars;
 

diff --git a/ui/app_list/views/apps_grid_view.cc b/ui/app_list/views/apps_grid_view.cc
index d162a14..9a9ff1a 100644
--- a/ui/app_list/views/apps_grid_view.cc
+++ b/ui/app_list/views/apps_grid_view.cc

@@ -1680,7 +1680,9 @@
   // Items can only be dropped into non-folders (which have no children) or
   // folders that have fewer than the max allowed items.
   // The OEM folder does not allow drag/drop of other items into it.
-  if (target_item->ChildItemCount() >= kMaxFolderItems ||
+  if (target_item->ChildItemCount() >= (is_fullscreen_app_list_enabled_
+                                            ? kMaxFolderItemsFullscreen
+                                            : kMaxFolderItems) ||
       IsOEMFolderItem(target_item)) {
     return false;
   }

diff --git a/ui/app_list/views/apps_grid_view_unittest.cc b/ui/app_list/views/apps_grid_view_unittest.cc
index acf08905..474a841b 100644
--- a/ui/app_list/views/apps_grid_view_unittest.cc
+++ b/ui/app_list/views/apps_grid_view_unittest.cc

@@ -113,11 +113,10 @@
   void SetUp() override {
     views::ViewsTestBase::SetUp();
 
-    // If the current test is parameterized.
-    if (testing::UnitTest::GetInstance()->current_test_info()->value_param()) {
-      test_with_fullscreen_ = GetParam();
-      if (test_with_fullscreen_)
-        EnableFullscreenAppList();
+    test_with_fullscreen_ = GetParam();
+    if (!test_with_fullscreen_) {
+      scoped_feature_list_.InitAndDisableFeature(
+          features::kEnableFullscreenAppList);
     }
 
     gfx::NativeView parent = GetContext();
@@ -247,6 +246,10 @@
     EXPECT_TRUE(apps_grid_view_->IsSelectedView(GetItemViewAt(index)));
   }
 
+  size_t GetMaxFolderItems() const {
+    return test_with_fullscreen_ ? kMaxFolderItemsFullscreen : kMaxFolderItems;
+  }
+
   AppListView* app_list_view_ = nullptr;    // Owned by native widget.
   AppsGridView* apps_grid_view_ = nullptr;  // Owned by |app_list_view_|.
   ContentsView* contents_view_ = nullptr;   // Owned by |app_list_view_|.
@@ -458,8 +461,8 @@
 }
 
 TEST_P(AppsGridViewTest, MouseDragMaxItemsInFolder) {
-  // Create and add a folder with 15 items in it.
-  size_t kTotalItems = kMaxFolderItems - 1;
+  // Create and add a folder with |GetMaxFolderItems() - 1| items.
+  size_t kTotalItems = GetMaxFolderItems() - 1;
   model_->CreateAndPopulateFolderWithApps(kTotalItems);
   EXPECT_EQ(1u, model_->top_level_item_list()->item_count());
   EXPECT_EQ(AppListFolderItem::kItemType,
@@ -473,9 +476,9 @@
   model_->PopulateAppWithId(kTotalItems + 1);
   EXPECT_EQ(3u, model_->top_level_item_list()->item_count());
   EXPECT_EQ(folder_item->id(), model_->top_level_item_list()->item_at(0)->id());
-  EXPECT_EQ(model_->GetItemName(kMaxFolderItems - 1),
+  EXPECT_EQ(model_->GetItemName(GetMaxFolderItems() - 1),
             model_->top_level_item_list()->item_at(1)->id());
-  EXPECT_EQ(model_->GetItemName(kMaxFolderItems),
+  EXPECT_EQ(model_->GetItemName(GetMaxFolderItems()),
             model_->top_level_item_list()->item_at(2)->id());
 
   gfx::Point from = GetItemTileRectAt(0, 1).CenterPoint();
@@ -486,8 +489,8 @@
   apps_grid_view_->EndDrag(false);
   EXPECT_EQ(2u, model_->top_level_item_list()->item_count());
   EXPECT_EQ(folder_item->id(), model_->top_level_item_list()->item_at(0)->id());
-  EXPECT_EQ(kMaxFolderItems, folder_item->ChildItemCount());
-  EXPECT_EQ(model_->GetItemName(kMaxFolderItems),
+  EXPECT_EQ(GetMaxFolderItems(), folder_item->ChildItemCount());
+  EXPECT_EQ(model_->GetItemName(GetMaxFolderItems()),
             model_->top_level_item_list()->item_at(1)->id());
   test_api_->LayoutToIdealBounds();
 
@@ -496,20 +499,15 @@
   SimulateDrag(AppsGridView::MOUSE, from, to);
   apps_grid_view_->EndDrag(false);
   EXPECT_EQ(2u, model_->top_level_item_list()->item_count());
-  EXPECT_EQ(kMaxFolderItems, folder_item->ChildItemCount());
+  EXPECT_EQ(GetMaxFolderItems(), folder_item->ChildItemCount());
   test_api_->LayoutToIdealBounds();
 }
 
 // Check that moving items around doesn't allow a drop to happen into a full
 // folder.
 TEST_P(AppsGridViewTest, MouseDragMaxItemsInFolderWithMovement) {
-  // TODO(newcomer): this test needs to be reevaluated for the fullscreen app
-  // list (http://crbug.com/759779).
-  if (features::IsFullscreenAppListEnabled())
-    return;
-
-  // Create and add a folder with 16 items in it.
-  size_t kTotalItems = kMaxFolderItems;
+  // Create and add a folder with |GetMaxFolderItems()| in it.
+  size_t kTotalItems = GetMaxFolderItems();
   model_->CreateAndPopulateFolderWithApps(kTotalItems);
   EXPECT_EQ(1u, model_->top_level_item_list()->item_count());
   EXPECT_EQ(AppListFolderItem::kItemType,
@@ -522,7 +520,7 @@
   model_->PopulateAppWithId(kTotalItems);
   EXPECT_EQ(2u, model_->top_level_item_list()->item_count());
   EXPECT_EQ(folder_item->id(), model_->top_level_item_list()->item_at(0)->id());
-  EXPECT_EQ(model_->GetItemName(kMaxFolderItems),
+  EXPECT_EQ(model_->GetItemName(GetMaxFolderItems()),
             model_->top_level_item_list()->item_at(1)->id());
 
   AppListItemView* folder_view =
@@ -552,16 +550,11 @@
 
   // The item should not have moved into the folder.
   EXPECT_EQ(2u, model_->top_level_item_list()->item_count());
-  EXPECT_EQ(kMaxFolderItems, folder_item->ChildItemCount());
+  EXPECT_EQ(GetMaxFolderItems(), folder_item->ChildItemCount());
   test_api_->LayoutToIdealBounds();
 }
 
 TEST_P(AppsGridViewTest, MouseDragItemReorder) {
-  // TODO(newcomer): this test needs to be reevaluated for the fullscreen app
-  // list (http://crbug.com/759779).
-  if (features::IsFullscreenAppListEnabled())
-    return;
-
   // Using a simulated 2x2 layout for the test. If fullscreen app list is
   // enabled, rows_per_page passed should be 3 as the first row is occupied by
   // suggested apps.
@@ -685,12 +678,7 @@
   test_api_->LayoutToIdealBounds();
 }
 
-TEST_F(AppsGridViewTest, MouseDragFlipPage) {
-  // TODO(newcomer): this test needs to be reevaluated for the fullscreen app
-  // list (http://crbug.com/759779).
-  if (features::IsFullscreenAppListEnabled())
-    return;
-
+TEST_P(AppsGridViewTest, MouseDragFlipPage) {
   apps_grid_view_->set_page_flip_delay_in_ms_for_testing(10);
   GetPaginationModel()->SetTransitionDurations(10, 10);
 
@@ -793,12 +781,9 @@
             model_->GetModelContent());
 }
 
+// TODO(warx): This test applies to bubble launcher only. Remove this test once
+// bubble launcher is removed from code base.
 TEST_P(AppsGridViewTest, HighlightWithKeyboard) {
-  // TODO(newcomer): this test needs to be reevaluated for the fullscreen app
-  // list (http://crbug.com/759779).
-  if (features::IsFullscreenAppListEnabled())
-    return;
-
   if (test_with_fullscreen_)
     return;
 

diff --git a/ui/gl/generate_bindings.py b/ui/gl/generate_bindings.py
index 9503ad28..6b8e085 100755
--- a/ui/gl/generate_bindings.py
+++ b/ui/gl/generate_bindings.py

@@ -760,7 +760,8 @@
   'arguments':
       'GLenum pname, GLsizei bufSize, GLsizei* length, GLint* data', },
 { 'return_type': 'void',
-  'versions': [{ 'name': 'glGetInternalformativ' }],
+  'versions': [{'name': 'glGetInternalformativ',
+                'extensions': ['GL_ARB_internalformat_query']}],
   'arguments': 'GLenum target, GLenum internalformat, GLenum pname, '
                'GLsizei bufSize, GLint* params', },
 { 'return_type': 'void',
@@ -770,6 +771,10 @@
       'GLenum target, GLenum internalformat, GLenum pname, GLsizei bufSize, '
       'GLsizei* length, GLint* params', },
 { 'return_type': 'void',
+  'versions': [{'name': 'glGetMultisamplefv',
+                'extensions': ['GL_ARB_texture_multisample']}],
+  'arguments': 'GLenum pname, GLuint index, GLfloat* val', },
+{ 'return_type': 'void',
   'versions': [{'name': 'glGetMultisamplefvRobustANGLE',
                 'extensions': ['GL_ANGLE_robust_client_memory']}],
   'arguments':
@@ -1273,6 +1278,9 @@
   'names': ['glPointParameteri'],
   'arguments': 'GLenum pname, GLint param', },
 { 'return_type': 'void',
+  'names': ['glPolygonMode'],
+  'arguments': 'GLenum face, GLenum mode', },
+{ 'return_type': 'void',
   'names': ['glPolygonOffset'],
   'arguments': 'GLfloat factor, GLfloat units', },
 { 'return_type': 'void',
@@ -1506,6 +1514,14 @@
   'names': ['glTestFenceNV'],
   'arguments': 'GLuint fence', },
 { 'return_type': 'void',
+  'names': ['glTexBuffer', 'glTexBufferOES', 'glTexBufferEXT'],
+  'arguments': 'GLenum target, GLenum internalformat, GLuint buffer', } ,
+{ 'return_type': 'void',
+  'names': ['glTexBufferRange', 'glTexBufferRangeOES', 'glTexBufferRangeEXT'],
+  'arguments':
+      'GLenum target, GLenum internalformat, GLuint buffer, '
+      'GLintptr offset, GLsizeiptr size', },
+{ 'return_type': 'void',
   'names': ['glTexImage2D'],
   'arguments':
       'GLenum target, GLint level, GLint internalformat, GLsizei width, '
@@ -1757,7 +1773,7 @@
 { 'return_type': 'void',
   'known_as': 'glVertexAttribDivisorANGLE',
   'names': ['glVertexAttribDivisorARB', 'glVertexAttribDivisorANGLE',
-            'glVertexAttribDivisor'],
+            'glVertexAttribDivisorEXT', 'glVertexAttribDivisor'],
   'arguments':
       'GLuint index, GLuint divisor', },
 { 'return_type': 'void',

diff --git a/ui/gl/gl_bindings_api_autogen_gl.h b/ui/gl/gl_bindings_api_autogen_gl.h
index ed10bfc0..1df021c87 100644
--- a/ui/gl/gl_bindings_api_autogen_gl.h
+++ b/ui/gl/gl_bindings_api_autogen_gl.h

@@ -528,6 +528,7 @@
                                         GLsizei bufSize,
                                         GLsizei* length,
                                         GLint* params) override;
+void glGetMultisamplefvFn(GLenum pname, GLuint index, GLfloat* val) override;
 void glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                      GLuint index,
                                      GLsizei bufSize,
@@ -861,6 +862,7 @@
 void glPauseTransformFeedbackFn(void) override;
 void glPixelStoreiFn(GLenum pname, GLint param) override;
 void glPointParameteriFn(GLenum pname, GLint param) override;
+void glPolygonModeFn(GLenum face, GLenum mode) override;
 void glPolygonOffsetFn(GLfloat factor, GLfloat units) override;
 void glPopDebugGroupFn() override;
 void glPopGroupMarkerEXTFn(void) override;
@@ -1039,6 +1041,14 @@
                                       GLenum coverMode) override;
 GLboolean glTestFenceAPPLEFn(GLuint fence) override;
 GLboolean glTestFenceNVFn(GLuint fence) override;
+void glTexBufferFn(GLenum target,
+                   GLenum internalformat,
+                   GLuint buffer) override;
+void glTexBufferRangeFn(GLenum target,
+                        GLenum internalformat,
+                        GLuint buffer,
+                        GLintptr offset,
+                        GLsizeiptr size) override;
 void glTexImage2DFn(GLenum target,
                     GLint level,
                     GLint internalformat,

diff --git a/ui/gl/gl_bindings_autogen_gl.cc b/ui/gl/gl_bindings_autogen_gl.cc
index 268b41e..37dc9e3 100644
--- a/ui/gl/gl_bindings_autogen_gl.cc
+++ b/ui/gl/gl_bindings_autogen_gl.cc

@@ -237,6 +237,7 @@
   fn.glGetIntegervRobustANGLEFn = 0;
   fn.glGetInternalformativFn = 0;
   fn.glGetInternalformativRobustANGLEFn = 0;
+  fn.glGetMultisamplefvFn = 0;
   fn.glGetMultisamplefvRobustANGLEFn = 0;
   fn.glGetnUniformfvRobustANGLEFn = 0;
   fn.glGetnUniformivRobustANGLEFn = 0;
@@ -368,6 +369,7 @@
   fn.glPixelStoreiFn =
       reinterpret_cast<glPixelStoreiProc>(GetGLProcAddress("glPixelStorei"));
   fn.glPointParameteriFn = 0;
+  fn.glPolygonModeFn = 0;
   fn.glPolygonOffsetFn = reinterpret_cast<glPolygonOffsetProc>(
       GetGLProcAddress("glPolygonOffset"));
   fn.glPopDebugGroupFn = 0;
@@ -431,6 +433,8 @@
   fn.glStencilThenCoverStrokePathNVFn = 0;
   fn.glTestFenceAPPLEFn = 0;
   fn.glTestFenceNVFn = 0;
+  fn.glTexBufferFn = 0;
+  fn.glTexBufferRangeFn = 0;
   fn.glTexImage2DFn =
       reinterpret_cast<glTexImage2DProc>(GetGLProcAddress("glTexImage2D"));
   fn.glTexImage2DRobustANGLEFn = 0;
@@ -576,6 +580,8 @@
       extensions.find("GL_ARB_get_program_binary ") != std::string::npos;
   ext.b_GL_ARB_instanced_arrays =
       extensions.find("GL_ARB_instanced_arrays ") != std::string::npos;
+  ext.b_GL_ARB_internalformat_query =
+      extensions.find("GL_ARB_internalformat_query ") != std::string::npos;
   ext.b_GL_ARB_map_buffer_range =
       extensions.find("GL_ARB_map_buffer_range ") != std::string::npos;
   ext.b_GL_ARB_occlusion_query =
@@ -589,6 +595,8 @@
   ext.b_GL_ARB_shader_image_load_store =
       extensions.find("GL_ARB_shader_image_load_store ") != std::string::npos;
   ext.b_GL_ARB_sync = extensions.find("GL_ARB_sync ") != std::string::npos;
+  ext.b_GL_ARB_texture_multisample =
+      extensions.find("GL_ARB_texture_multisample ") != std::string::npos;
   ext.b_GL_ARB_texture_storage =
       extensions.find("GL_ARB_texture_storage ") != std::string::npos;
   ext.b_GL_ARB_timer_query =
@@ -633,6 +641,8 @@
       extensions.find("GL_EXT_framebuffer_object ") != std::string::npos;
   ext.b_GL_EXT_gpu_shader4 =
       extensions.find("GL_EXT_gpu_shader4 ") != std::string::npos;
+  ext.b_GL_EXT_instanced_arrays =
+      extensions.find("GL_EXT_instanced_arrays ") != std::string::npos;
   ext.b_GL_EXT_map_buffer_range =
       extensions.find("GL_EXT_map_buffer_range ") != std::string::npos;
   ext.b_GL_EXT_multisampled_render_to_texture =
@@ -644,6 +654,10 @@
       extensions.find("GL_EXT_robustness ") != std::string::npos;
   ext.b_GL_EXT_shader_image_load_store =
       extensions.find("GL_EXT_shader_image_load_store ") != std::string::npos;
+  ext.b_GL_EXT_texture_buffer =
+      extensions.find("GL_EXT_texture_buffer ") != std::string::npos;
+  ext.b_GL_EXT_texture_buffer_object =
+      extensions.find("GL_EXT_texture_buffer_object ") != std::string::npos;
   ext.b_GL_EXT_texture_storage =
       extensions.find("GL_EXT_texture_storage ") != std::string::npos;
   ext.b_GL_EXT_timer_query =
@@ -675,6 +689,8 @@
       extensions.find("GL_OES_get_program_binary ") != std::string::npos;
   ext.b_GL_OES_mapbuffer =
       extensions.find("GL_OES_mapbuffer ") != std::string::npos;
+  ext.b_GL_OES_texture_buffer =
+      extensions.find("GL_OES_texture_buffer ") != std::string::npos;
   ext.b_GL_OES_vertex_array_object =
       extensions.find("GL_OES_vertex_array_object ") != std::string::npos;
 
@@ -1453,7 +1469,8 @@
             GetGLProcAddress("glGetIntegervRobustANGLE"));
   }
 
-  if (ver->IsAtLeastGL(4u, 2u) || ver->IsAtLeastGLES(3u, 0u)) {
+  if (ver->IsAtLeastGL(4u, 2u) || ver->IsAtLeastGLES(3u, 0u) ||
+      ext.b_GL_ARB_internalformat_query) {
     fn.glGetInternalformativFn = reinterpret_cast<glGetInternalformativProc>(
         GetGLProcAddress("glGetInternalformativ"));
   }
@@ -1464,6 +1481,12 @@
             GetGLProcAddress("glGetInternalformativRobustANGLE"));
   }
 
+  if (ver->IsAtLeastGL(3u, 2u) || ver->IsAtLeastGLES(3u, 1u) ||
+      ext.b_GL_ARB_texture_multisample) {
+    fn.glGetMultisamplefvFn = reinterpret_cast<glGetMultisamplefvProc>(
+        GetGLProcAddress("glGetMultisamplefv"));
+  }
+
   if (ext.b_GL_ANGLE_robust_client_memory) {
     fn.glGetMultisamplefvRobustANGLEFn =
         reinterpret_cast<glGetMultisamplefvRobustANGLEProc>(
@@ -2020,6 +2043,11 @@
         GetGLProcAddress("glPointParameteri"));
   }
 
+  if (!ver->is_es) {
+    fn.glPolygonModeFn =
+        reinterpret_cast<glPolygonModeProc>(GetGLProcAddress("glPolygonMode"));
+  }
+
   if (ver->IsAtLeastGL(4u, 3u) || ver->IsAtLeastGLES(3u, 2u)) {
     fn.glPopDebugGroupFn = reinterpret_cast<glPopDebugGroupProc>(
         GetGLProcAddress("glPopDebugGroup"));
@@ -2271,6 +2299,29 @@
         reinterpret_cast<glTestFenceNVProc>(GetGLProcAddress("glTestFenceNV"));
   }
 
+  if (ver->IsAtLeastGLES(3u, 2u) || ver->IsAtLeastGL(3u, 1u)) {
+    fn.glTexBufferFn =
+        reinterpret_cast<glTexBufferProc>(GetGLProcAddress("glTexBuffer"));
+  } else if (ext.b_GL_OES_texture_buffer) {
+    fn.glTexBufferFn =
+        reinterpret_cast<glTexBufferProc>(GetGLProcAddress("glTexBufferOES"));
+  } else if (ext.b_GL_EXT_texture_buffer_object ||
+             ext.b_GL_EXT_texture_buffer) {
+    fn.glTexBufferFn =
+        reinterpret_cast<glTexBufferProc>(GetGLProcAddress("glTexBufferEXT"));
+  }
+
+  if (ver->IsAtLeastGL(4u, 3u) || ver->IsAtLeastGLES(3u, 2u)) {
+    fn.glTexBufferRangeFn = reinterpret_cast<glTexBufferRangeProc>(
+        GetGLProcAddress("glTexBufferRange"));
+  } else if (ext.b_GL_OES_texture_buffer) {
+    fn.glTexBufferRangeFn = reinterpret_cast<glTexBufferRangeProc>(
+        GetGLProcAddress("glTexBufferRangeOES"));
+  } else if (ext.b_GL_EXT_texture_buffer) {
+    fn.glTexBufferRangeFn = reinterpret_cast<glTexBufferRangeProc>(
+        GetGLProcAddress("glTexBufferRangeEXT"));
+  }
+
   if (ext.b_GL_ANGLE_robust_client_memory) {
     fn.glTexImage2DRobustANGLEFn =
         reinterpret_cast<glTexImage2DRobustANGLEProc>(
@@ -2449,6 +2500,10 @@
     fn.glVertexAttribDivisorANGLEFn =
         reinterpret_cast<glVertexAttribDivisorANGLEProc>(
             GetGLProcAddress("glVertexAttribDivisorANGLE"));
+  } else if (ext.b_GL_EXT_instanced_arrays) {
+    fn.glVertexAttribDivisorANGLEFn =
+        reinterpret_cast<glVertexAttribDivisorANGLEProc>(
+            GetGLProcAddress("glVertexAttribDivisorEXT"));
   }
 
   if (ver->IsAtLeastGL(3u, 0u) || ver->IsAtLeastGLES(3u, 0u)) {
@@ -3560,6 +3615,10 @@
                                                  bufSize, length, params);
 }
 
+void GLApiBase::glGetMultisamplefvFn(GLenum pname, GLuint index, GLfloat* val) {
+  driver_->fn.glGetMultisamplefvFn(pname, index, val);
+}
+
 void GLApiBase::glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                                 GLuint index,
                                                 GLsizei bufSize,
@@ -4271,6 +4330,10 @@
   driver_->fn.glPointParameteriFn(pname, param);
 }
 
+void GLApiBase::glPolygonModeFn(GLenum face, GLenum mode) {
+  driver_->fn.glPolygonModeFn(face, mode);
+}
+
 void GLApiBase::glPolygonOffsetFn(GLfloat factor, GLfloat units) {
   driver_->fn.glPolygonOffsetFn(factor, units);
 }
@@ -4630,6 +4693,20 @@
   return driver_->fn.glTestFenceNVFn(fence);
 }
 
+void GLApiBase::glTexBufferFn(GLenum target,
+                              GLenum internalformat,
+                              GLuint buffer) {
+  driver_->fn.glTexBufferFn(target, internalformat, buffer);
+}
+
+void GLApiBase::glTexBufferRangeFn(GLenum target,
+                                   GLenum internalformat,
+                                   GLuint buffer,
+                                   GLintptr offset,
+                                   GLsizeiptr size) {
+  driver_->fn.glTexBufferRangeFn(target, internalformat, buffer, offset, size);
+}
+
 void GLApiBase::glTexImage2DFn(GLenum target,
                                GLint level,
                                GLint internalformat,
@@ -6388,6 +6465,13 @@
                                               bufSize, length, params);
 }
 
+void TraceGLApi::glGetMultisamplefvFn(GLenum pname,
+                                      GLuint index,
+                                      GLfloat* val) {
+  TRACE_EVENT_BINARY_EFFICIENT0("gpu", "TraceGLAPI::glGetMultisamplefv")
+  gl_api_->glGetMultisamplefvFn(pname, index, val);
+}
+
 void TraceGLApi::glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                                  GLuint index,
                                                  GLsizei bufSize,
@@ -7229,6 +7313,11 @@
   gl_api_->glPointParameteriFn(pname, param);
 }
 
+void TraceGLApi::glPolygonModeFn(GLenum face, GLenum mode) {
+  TRACE_EVENT_BINARY_EFFICIENT0("gpu", "TraceGLAPI::glPolygonMode")
+  gl_api_->glPolygonModeFn(face, mode);
+}
+
 void TraceGLApi::glPolygonOffsetFn(GLfloat factor, GLfloat units) {
   TRACE_EVENT_BINARY_EFFICIENT0("gpu", "TraceGLAPI::glPolygonOffset")
   gl_api_->glPolygonOffsetFn(factor, units);
@@ -7653,6 +7742,22 @@
   return gl_api_->glTestFenceNVFn(fence);
 }
 
+void TraceGLApi::glTexBufferFn(GLenum target,
+                               GLenum internalformat,
+                               GLuint buffer) {
+  TRACE_EVENT_BINARY_EFFICIENT0("gpu", "TraceGLAPI::glTexBuffer")
+  gl_api_->glTexBufferFn(target, internalformat, buffer);
+}
+
+void TraceGLApi::glTexBufferRangeFn(GLenum target,
+                                    GLenum internalformat,
+                                    GLuint buffer,
+                                    GLintptr offset,
+                                    GLsizeiptr size) {
+  TRACE_EVENT_BINARY_EFFICIENT0("gpu", "TraceGLAPI::glTexBufferRange")
+  gl_api_->glTexBufferRangeFn(target, internalformat, buffer, offset, size);
+}
+
 void TraceGLApi::glTexImage2DFn(GLenum target,
                                 GLint level,
                                 GLint internalformat,
@@ -9887,6 +9992,15 @@
                                               bufSize, length, params);
 }
 
+void DebugGLApi::glGetMultisamplefvFn(GLenum pname,
+                                      GLuint index,
+                                      GLfloat* val) {
+  GL_SERVICE_LOG("glGetMultisamplefv"
+                 << "(" << GLEnums::GetStringEnum(pname) << ", " << index
+                 << ", " << static_cast<const void*>(val) << ")");
+  gl_api_->glGetMultisamplefvFn(pname, index, val);
+}
+
 void DebugGLApi::glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                                  GLuint index,
                                                  GLsizei bufSize,
@@ -11011,6 +11125,13 @@
   gl_api_->glPointParameteriFn(pname, param);
 }
 
+void DebugGLApi::glPolygonModeFn(GLenum face, GLenum mode) {
+  GL_SERVICE_LOG("glPolygonMode"
+                 << "(" << GLEnums::GetStringEnum(face) << ", "
+                 << GLEnums::GetStringEnum(mode) << ")");
+  gl_api_->glPolygonModeFn(face, mode);
+}
+
 void DebugGLApi::glPolygonOffsetFn(GLfloat factor, GLfloat units) {
   GL_SERVICE_LOG("glPolygonOffset"
                  << "(" << factor << ", " << units << ")");
@@ -11577,6 +11698,28 @@
   return result;
 }
 
+void DebugGLApi::glTexBufferFn(GLenum target,
+                               GLenum internalformat,
+                               GLuint buffer) {
+  GL_SERVICE_LOG("glTexBuffer"
+                 << "(" << GLEnums::GetStringEnum(target) << ", "
+                 << GLEnums::GetStringEnum(internalformat) << ", " << buffer
+                 << ")");
+  gl_api_->glTexBufferFn(target, internalformat, buffer);
+}
+
+void DebugGLApi::glTexBufferRangeFn(GLenum target,
+                                    GLenum internalformat,
+                                    GLuint buffer,
+                                    GLintptr offset,
+                                    GLsizeiptr size) {
+  GL_SERVICE_LOG("glTexBufferRange"
+                 << "(" << GLEnums::GetStringEnum(target) << ", "
+                 << GLEnums::GetStringEnum(internalformat) << ", " << buffer
+                 << ", " << offset << ", " << size << ")");
+  gl_api_->glTexBufferRangeFn(target, internalformat, buffer, offset, size);
+}
+
 void DebugGLApi::glTexImage2DFn(GLenum target,
                                 GLint level,
                                 GLint internalformat,
@@ -13735,6 +13878,15 @@
                 "current GL context";
 }
 
+void NoContextGLApi::glGetMultisamplefvFn(GLenum pname,
+                                          GLuint index,
+                                          GLfloat* val) {
+  NOTREACHED()
+      << "Trying to call glGetMultisamplefv() without current GL context";
+  LOG(ERROR)
+      << "Trying to call glGetMultisamplefv() without current GL context";
+}
+
 void NoContextGLApi::glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                                      GLuint index,
                                                      GLsizei bufSize,
@@ -14703,6 +14855,11 @@
   LOG(ERROR) << "Trying to call glPointParameteri() without current GL context";
 }
 
+void NoContextGLApi::glPolygonModeFn(GLenum face, GLenum mode) {
+  NOTREACHED() << "Trying to call glPolygonMode() without current GL context";
+  LOG(ERROR) << "Trying to call glPolygonMode() without current GL context";
+}
+
 void NoContextGLApi::glPolygonOffsetFn(GLfloat factor, GLfloat units) {
   NOTREACHED() << "Trying to call glPolygonOffset() without current GL context";
   LOG(ERROR) << "Trying to call glPolygonOffset() without current GL context";
@@ -15177,6 +15334,23 @@
   return GL_FALSE;
 }
 
+void NoContextGLApi::glTexBufferFn(GLenum target,
+                                   GLenum internalformat,
+                                   GLuint buffer) {
+  NOTREACHED() << "Trying to call glTexBuffer() without current GL context";
+  LOG(ERROR) << "Trying to call glTexBuffer() without current GL context";
+}
+
+void NoContextGLApi::glTexBufferRangeFn(GLenum target,
+                                        GLenum internalformat,
+                                        GLuint buffer,
+                                        GLintptr offset,
+                                        GLsizeiptr size) {
+  NOTREACHED()
+      << "Trying to call glTexBufferRange() without current GL context";
+  LOG(ERROR) << "Trying to call glTexBufferRange() without current GL context";
+}
+
 void NoContextGLApi::glTexImage2DFn(GLenum target,
                                     GLint level,
                                     GLint internalformat,

diff --git a/ui/gl/gl_bindings_autogen_gl.h b/ui/gl/gl_bindings_autogen_gl.h
index a895d6c..816a0c5 100644
--- a/ui/gl/gl_bindings_autogen_gl.h
+++ b/ui/gl/gl_bindings_autogen_gl.h

@@ -613,6 +613,9 @@
     GLsizei bufSize,
     GLsizei* length,
     GLint* params);
+typedef void(GL_BINDING_CALL* glGetMultisamplefvProc)(GLenum pname,
+                                                      GLuint index,
+                                                      GLfloat* val);
 typedef void(GL_BINDING_CALL* glGetMultisamplefvRobustANGLEProc)(
     GLenum pname,
     GLuint index,
@@ -1016,6 +1019,7 @@
 typedef void(GL_BINDING_CALL* glPauseTransformFeedbackProc)(void);
 typedef void(GL_BINDING_CALL* glPixelStoreiProc)(GLenum pname, GLint param);
 typedef void(GL_BINDING_CALL* glPointParameteriProc)(GLenum pname, GLint param);
+typedef void(GL_BINDING_CALL* glPolygonModeProc)(GLenum face, GLenum mode);
 typedef void(GL_BINDING_CALL* glPolygonOffsetProc)(GLfloat factor,
                                                    GLfloat units);
 typedef void(GL_BINDING_CALL* glPopDebugGroupProc)();
@@ -1225,6 +1229,14 @@
     GLenum coverMode);
 typedef GLboolean(GL_BINDING_CALL* glTestFenceAPPLEProc)(GLuint fence);
 typedef GLboolean(GL_BINDING_CALL* glTestFenceNVProc)(GLuint fence);
+typedef void(GL_BINDING_CALL* glTexBufferProc)(GLenum target,
+                                               GLenum internalformat,
+                                               GLuint buffer);
+typedef void(GL_BINDING_CALL* glTexBufferRangeProc)(GLenum target,
+                                                    GLenum internalformat,
+                                                    GLuint buffer,
+                                                    GLintptr offset,
+                                                    GLsizeiptr size);
 typedef void(GL_BINDING_CALL* glTexImage2DProc)(GLenum target,
                                                 GLint level,
                                                 GLint internalformat,
@@ -1545,6 +1557,7 @@
   bool b_GL_ARB_draw_instanced;
   bool b_GL_ARB_get_program_binary;
   bool b_GL_ARB_instanced_arrays;
+  bool b_GL_ARB_internalformat_query;
   bool b_GL_ARB_map_buffer_range;
   bool b_GL_ARB_occlusion_query;
   bool b_GL_ARB_program_interface_query;
@@ -1552,6 +1565,7 @@
   bool b_GL_ARB_sampler_objects;
   bool b_GL_ARB_shader_image_load_store;
   bool b_GL_ARB_sync;
+  bool b_GL_ARB_texture_multisample;
   bool b_GL_ARB_texture_storage;
   bool b_GL_ARB_timer_query;
   bool b_GL_ARB_transform_feedback2;
@@ -1572,11 +1586,14 @@
   bool b_GL_EXT_framebuffer_multisample;
   bool b_GL_EXT_framebuffer_object;
   bool b_GL_EXT_gpu_shader4;
+  bool b_GL_EXT_instanced_arrays;
   bool b_GL_EXT_map_buffer_range;
   bool b_GL_EXT_multisampled_render_to_texture;
   bool b_GL_EXT_occlusion_query_boolean;
   bool b_GL_EXT_robustness;
   bool b_GL_EXT_shader_image_load_store;
+  bool b_GL_EXT_texture_buffer;
+  bool b_GL_EXT_texture_buffer_object;
   bool b_GL_EXT_texture_storage;
   bool b_GL_EXT_timer_query;
   bool b_GL_EXT_transform_feedback;
@@ -1593,6 +1610,7 @@
   bool b_GL_OES_EGL_image;
   bool b_GL_OES_get_program_binary;
   bool b_GL_OES_mapbuffer;
+  bool b_GL_OES_texture_buffer;
   bool b_GL_OES_vertex_array_object;
 };
 
@@ -1771,6 +1789,7 @@
   glGetIntegervRobustANGLEProc glGetIntegervRobustANGLEFn;
   glGetInternalformativProc glGetInternalformativFn;
   glGetInternalformativRobustANGLEProc glGetInternalformativRobustANGLEFn;
+  glGetMultisamplefvProc glGetMultisamplefvFn;
   glGetMultisamplefvRobustANGLEProc glGetMultisamplefvRobustANGLEFn;
   glGetnUniformfvRobustANGLEProc glGetnUniformfvRobustANGLEFn;
   glGetnUniformivRobustANGLEProc glGetnUniformivRobustANGLEFn;
@@ -1881,6 +1900,7 @@
   glPauseTransformFeedbackProc glPauseTransformFeedbackFn;
   glPixelStoreiProc glPixelStoreiFn;
   glPointParameteriProc glPointParameteriFn;
+  glPolygonModeProc glPolygonModeFn;
   glPolygonOffsetProc glPolygonOffsetFn;
   glPopDebugGroupProc glPopDebugGroupFn;
   glPopGroupMarkerEXTProc glPopGroupMarkerEXTFn;
@@ -1936,6 +1956,8 @@
   glStencilThenCoverStrokePathNVProc glStencilThenCoverStrokePathNVFn;
   glTestFenceAPPLEProc glTestFenceAPPLEFn;
   glTestFenceNVProc glTestFenceNVFn;
+  glTexBufferProc glTexBufferFn;
+  glTexBufferRangeProc glTexBufferRangeFn;
   glTexImage2DProc glTexImage2DFn;
   glTexImage2DRobustANGLEProc glTexImage2DRobustANGLEFn;
   glTexImage3DProc glTexImage3DFn;
@@ -2547,6 +2569,9 @@
                                                   GLsizei bufSize,
                                                   GLsizei* length,
                                                   GLint* params) = 0;
+  virtual void glGetMultisamplefvFn(GLenum pname,
+                                    GLuint index,
+                                    GLfloat* val) = 0;
   virtual void glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                                GLuint index,
                                                GLsizei bufSize,
@@ -2900,6 +2925,7 @@
   virtual void glPauseTransformFeedbackFn(void) = 0;
   virtual void glPixelStoreiFn(GLenum pname, GLint param) = 0;
   virtual void glPointParameteriFn(GLenum pname, GLint param) = 0;
+  virtual void glPolygonModeFn(GLenum face, GLenum mode) = 0;
   virtual void glPolygonOffsetFn(GLfloat factor, GLfloat units) = 0;
   virtual void glPopDebugGroupFn() = 0;
   virtual void glPopGroupMarkerEXTFn(void) = 0;
@@ -3086,6 +3112,14 @@
                                                 GLenum coverMode) = 0;
   virtual GLboolean glTestFenceAPPLEFn(GLuint fence) = 0;
   virtual GLboolean glTestFenceNVFn(GLuint fence) = 0;
+  virtual void glTexBufferFn(GLenum target,
+                             GLenum internalformat,
+                             GLuint buffer) = 0;
+  virtual void glTexBufferRangeFn(GLenum target,
+                                  GLenum internalformat,
+                                  GLuint buffer,
+                                  GLintptr offset,
+                                  GLsizeiptr size) = 0;
   virtual void glTexImage2DFn(GLenum target,
                               GLint level,
                               GLint internalformat,
@@ -3600,6 +3634,7 @@
   ::gl::g_current_gl_context->glGetInternalformativFn
 #define glGetInternalformativRobustANGLE \
   ::gl::g_current_gl_context->glGetInternalformativRobustANGLEFn
+#define glGetMultisamplefv ::gl::g_current_gl_context->glGetMultisamplefvFn
 #define glGetMultisamplefvRobustANGLE \
   ::gl::g_current_gl_context->glGetMultisamplefvRobustANGLEFn
 #define glGetnUniformfvRobustANGLE \
@@ -3760,6 +3795,7 @@
   ::gl::g_current_gl_context->glPauseTransformFeedbackFn
 #define glPixelStorei ::gl::g_current_gl_context->glPixelStoreiFn
 #define glPointParameteri ::gl::g_current_gl_context->glPointParameteriFn
+#define glPolygonMode ::gl::g_current_gl_context->glPolygonModeFn
 #define glPolygonOffset ::gl::g_current_gl_context->glPolygonOffsetFn
 #define glPopDebugGroup ::gl::g_current_gl_context->glPopDebugGroupFn
 #define glPopGroupMarkerEXT ::gl::g_current_gl_context->glPopGroupMarkerEXTFn
@@ -3837,6 +3873,8 @@
   ::gl::g_current_gl_context->glStencilThenCoverStrokePathNVFn
 #define glTestFenceAPPLE ::gl::g_current_gl_context->glTestFenceAPPLEFn
 #define glTestFenceNV ::gl::g_current_gl_context->glTestFenceNVFn
+#define glTexBuffer ::gl::g_current_gl_context->glTexBufferFn
+#define glTexBufferRange ::gl::g_current_gl_context->glTexBufferRangeFn
 #define glTexImage2D ::gl::g_current_gl_context->glTexImage2DFn
 #define glTexImage2DRobustANGLE \
   ::gl::g_current_gl_context->glTexImage2DRobustANGLEFn

diff --git a/ui/gl/gl_bindings_autogen_mock.cc b/ui/gl/gl_bindings_autogen_mock.cc
index 2fc21f9..812f910 100644
--- a/ui/gl/gl_bindings_autogen_mock.cc
+++ b/ui/gl/gl_bindings_autogen_mock.cc

@@ -1715,6 +1715,13 @@
                                              bufSize, length, params);
 }
 
+void GL_BINDING_CALL MockGLInterface::Mock_glGetMultisamplefv(GLenum pname,
+                                                              GLuint index,
+                                                              GLfloat* val) {
+  MakeFunctionUnique("glGetMultisamplefv");
+  interface_->GetMultisamplefv(pname, index, val);
+}
+
 void GL_BINDING_CALL
 MockGLInterface::Mock_glGetMultisamplefvRobustANGLE(GLenum pname,
                                                     GLuint index,
@@ -2797,6 +2804,12 @@
   interface_->PointParameteri(pname, param);
 }
 
+void GL_BINDING_CALL MockGLInterface::Mock_glPolygonMode(GLenum face,
+                                                         GLenum mode) {
+  MakeFunctionUnique("glPolygonMode");
+  interface_->PolygonMode(face, mode);
+}
+
 void GL_BINDING_CALL MockGLInterface::Mock_glPolygonOffset(GLfloat factor,
                                                            GLfloat units) {
   MakeFunctionUnique("glPolygonOffset");
@@ -3281,6 +3294,57 @@
   return interface_->TestFenceNV(fence);
 }
 
+void GL_BINDING_CALL MockGLInterface::Mock_glTexBuffer(GLenum target,
+                                                       GLenum internalformat,
+                                                       GLuint buffer) {
+  MakeFunctionUnique("glTexBuffer");
+  interface_->TexBuffer(target, internalformat, buffer);
+}
+
+void GL_BINDING_CALL MockGLInterface::Mock_glTexBufferEXT(GLenum target,
+                                                          GLenum internalformat,
+                                                          GLuint buffer) {
+  MakeFunctionUnique("glTexBufferEXT");
+  interface_->TexBuffer(target, internalformat, buffer);
+}
+
+void GL_BINDING_CALL MockGLInterface::Mock_glTexBufferOES(GLenum target,
+                                                          GLenum internalformat,
+                                                          GLuint buffer) {
+  MakeFunctionUnique("glTexBufferOES");
+  interface_->TexBuffer(target, internalformat, buffer);
+}
+
+void GL_BINDING_CALL
+MockGLInterface::Mock_glTexBufferRange(GLenum target,
+                                       GLenum internalformat,
+                                       GLuint buffer,
+                                       GLintptr offset,
+                                       GLsizeiptr size) {
+  MakeFunctionUnique("glTexBufferRange");
+  interface_->TexBufferRange(target, internalformat, buffer, offset, size);
+}
+
+void GL_BINDING_CALL
+MockGLInterface::Mock_glTexBufferRangeEXT(GLenum target,
+                                          GLenum internalformat,
+                                          GLuint buffer,
+                                          GLintptr offset,
+                                          GLsizeiptr size) {
+  MakeFunctionUnique("glTexBufferRangeEXT");
+  interface_->TexBufferRange(target, internalformat, buffer, offset, size);
+}
+
+void GL_BINDING_CALL
+MockGLInterface::Mock_glTexBufferRangeOES(GLenum target,
+                                          GLenum internalformat,
+                                          GLuint buffer,
+                                          GLintptr offset,
+                                          GLsizeiptr size) {
+  MakeFunctionUnique("glTexBufferRangeOES");
+  interface_->TexBufferRange(target, internalformat, buffer, offset, size);
+}
+
 void GL_BINDING_CALL MockGLInterface::Mock_glTexImage2D(GLenum target,
                                                         GLint level,
                                                         GLint internalformat,
@@ -3881,6 +3945,12 @@
   interface_->VertexAttribDivisorANGLE(index, divisor);
 }
 
+void GL_BINDING_CALL
+MockGLInterface::Mock_glVertexAttribDivisorEXT(GLuint index, GLuint divisor) {
+  MakeFunctionUnique("glVertexAttribDivisorEXT");
+  interface_->VertexAttribDivisorANGLE(index, divisor);
+}
+
 void GL_BINDING_CALL MockGLInterface::Mock_glVertexAttribI4i(GLuint indx,
                                                              GLint x,
                                                              GLint y,
@@ -4445,6 +4515,8 @@
   if (strcmp(name, "glGetInternalformativRobustANGLE") == 0)
     return reinterpret_cast<GLFunctionPointerType>(
         Mock_glGetInternalformativRobustANGLE);
+  if (strcmp(name, "glGetMultisamplefv") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glGetMultisamplefv);
   if (strcmp(name, "glGetMultisamplefvRobustANGLE") == 0)
     return reinterpret_cast<GLFunctionPointerType>(
         Mock_glGetMultisamplefvRobustANGLE);
@@ -4761,6 +4833,8 @@
     return reinterpret_cast<GLFunctionPointerType>(Mock_glPixelStorei);
   if (strcmp(name, "glPointParameteri") == 0)
     return reinterpret_cast<GLFunctionPointerType>(Mock_glPointParameteri);
+  if (strcmp(name, "glPolygonMode") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glPolygonMode);
   if (strcmp(name, "glPolygonOffset") == 0)
     return reinterpret_cast<GLFunctionPointerType>(Mock_glPolygonOffset);
   if (strcmp(name, "glPopDebugGroup") == 0)
@@ -4897,6 +4971,18 @@
     return reinterpret_cast<GLFunctionPointerType>(Mock_glTestFenceAPPLE);
   if (strcmp(name, "glTestFenceNV") == 0)
     return reinterpret_cast<GLFunctionPointerType>(Mock_glTestFenceNV);
+  if (strcmp(name, "glTexBuffer") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glTexBuffer);
+  if (strcmp(name, "glTexBufferEXT") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glTexBufferEXT);
+  if (strcmp(name, "glTexBufferOES") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glTexBufferOES);
+  if (strcmp(name, "glTexBufferRange") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glTexBufferRange);
+  if (strcmp(name, "glTexBufferRangeEXT") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glTexBufferRangeEXT);
+  if (strcmp(name, "glTexBufferRangeOES") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(Mock_glTexBufferRangeOES);
   if (strcmp(name, "glTexImage2D") == 0)
     return reinterpret_cast<GLFunctionPointerType>(Mock_glTexImage2D);
   if (strcmp(name, "glTexImage2DRobustANGLE") == 0)
@@ -5049,6 +5135,9 @@
   if (strcmp(name, "glVertexAttribDivisorARB") == 0)
     return reinterpret_cast<GLFunctionPointerType>(
         Mock_glVertexAttribDivisorARB);
+  if (strcmp(name, "glVertexAttribDivisorEXT") == 0)
+    return reinterpret_cast<GLFunctionPointerType>(
+        Mock_glVertexAttribDivisorEXT);
   if (strcmp(name, "glVertexAttribI4i") == 0)
     return reinterpret_cast<GLFunctionPointerType>(Mock_glVertexAttribI4i);
   if (strcmp(name, "glVertexAttribI4iv") == 0)

diff --git a/ui/gl/gl_bindings_autogen_mock.h b/ui/gl/gl_bindings_autogen_mock.h
index 0726b0e..6a2e2c6 100644
--- a/ui/gl/gl_bindings_autogen_mock.h
+++ b/ui/gl/gl_bindings_autogen_mock.h

@@ -710,6 +710,9 @@
                                       GLsizei bufSize,
                                       GLsizei* length,
                                       GLint* params);
+static void GL_BINDING_CALL Mock_glGetMultisamplefv(GLenum pname,
+                                                    GLuint index,
+                                                    GLfloat* val);
 static void GL_BINDING_CALL Mock_glGetMultisamplefvRobustANGLE(GLenum pname,
                                                                GLuint index,
                                                                GLsizei bufSize,
@@ -1172,6 +1175,7 @@
 static void GL_BINDING_CALL Mock_glPauseTransformFeedback(void);
 static void GL_BINDING_CALL Mock_glPixelStorei(GLenum pname, GLint param);
 static void GL_BINDING_CALL Mock_glPointParameteri(GLenum pname, GLint param);
+static void GL_BINDING_CALL Mock_glPolygonMode(GLenum face, GLenum mode);
 static void GL_BINDING_CALL Mock_glPolygonOffset(GLfloat factor, GLfloat units);
 static void GL_BINDING_CALL Mock_glPopDebugGroup();
 static void GL_BINDING_CALL Mock_glPopDebugGroupKHR();
@@ -1392,6 +1396,30 @@
                                     GLenum coverMode);
 static GLboolean GL_BINDING_CALL Mock_glTestFenceAPPLE(GLuint fence);
 static GLboolean GL_BINDING_CALL Mock_glTestFenceNV(GLuint fence);
+static void GL_BINDING_CALL Mock_glTexBuffer(GLenum target,
+                                             GLenum internalformat,
+                                             GLuint buffer);
+static void GL_BINDING_CALL Mock_glTexBufferEXT(GLenum target,
+                                                GLenum internalformat,
+                                                GLuint buffer);
+static void GL_BINDING_CALL Mock_glTexBufferOES(GLenum target,
+                                                GLenum internalformat,
+                                                GLuint buffer);
+static void GL_BINDING_CALL Mock_glTexBufferRange(GLenum target,
+                                                  GLenum internalformat,
+                                                  GLuint buffer,
+                                                  GLintptr offset,
+                                                  GLsizeiptr size);
+static void GL_BINDING_CALL Mock_glTexBufferRangeEXT(GLenum target,
+                                                     GLenum internalformat,
+                                                     GLuint buffer,
+                                                     GLintptr offset,
+                                                     GLsizeiptr size);
+static void GL_BINDING_CALL Mock_glTexBufferRangeOES(GLenum target,
+                                                     GLenum internalformat,
+                                                     GLuint buffer,
+                                                     GLintptr offset,
+                                                     GLsizeiptr size);
 static void GL_BINDING_CALL Mock_glTexImage2D(GLenum target,
                                               GLint level,
                                               GLint internalformat,
@@ -1664,6 +1692,8 @@
                                                             GLuint divisor);
 static void GL_BINDING_CALL Mock_glVertexAttribDivisorARB(GLuint index,
                                                           GLuint divisor);
+static void GL_BINDING_CALL Mock_glVertexAttribDivisorEXT(GLuint index,
+                                                          GLuint divisor);
 static void GL_BINDING_CALL
 Mock_glVertexAttribI4i(GLuint indx, GLint x, GLint y, GLint z, GLint w);
 static void GL_BINDING_CALL Mock_glVertexAttribI4iv(GLuint indx,

diff --git a/ui/gl/gl_mock_autogen_gl.h b/ui/gl/gl_mock_autogen_gl.h
index 381389a4..4e89f05 100644
--- a/ui/gl/gl_mock_autogen_gl.h
+++ b/ui/gl/gl_mock_autogen_gl.h

@@ -515,6 +515,7 @@
                   GLsizei bufSize,
                   GLsizei* length,
                   GLint* params));
+MOCK_METHOD3(GetMultisamplefv, void(GLenum pname, GLuint index, GLfloat* val));
 MOCK_METHOD5(GetMultisamplefvRobustANGLE,
              void(GLenum pname,
                   GLuint index,
@@ -876,6 +877,7 @@
 MOCK_METHOD0(PauseTransformFeedback, void());
 MOCK_METHOD2(PixelStorei, void(GLenum pname, GLint param));
 MOCK_METHOD2(PointParameteri, void(GLenum pname, GLint param));
+MOCK_METHOD2(PolygonMode, void(GLenum face, GLenum mode));
 MOCK_METHOD2(PolygonOffset, void(GLfloat factor, GLfloat units));
 MOCK_METHOD0(PopDebugGroup, void());
 MOCK_METHOD0(PopGroupMarkerEXT, void());
@@ -1032,6 +1034,14 @@
              void(GLuint path, GLint reference, GLuint mask, GLenum coverMode));
 MOCK_METHOD1(TestFenceAPPLE, GLboolean(GLuint fence));
 MOCK_METHOD1(TestFenceNV, GLboolean(GLuint fence));
+MOCK_METHOD3(TexBuffer,
+             void(GLenum target, GLenum internalformat, GLuint buffer));
+MOCK_METHOD5(TexBufferRange,
+             void(GLenum target,
+                  GLenum internalformat,
+                  GLuint buffer,
+                  GLintptr offset,
+                  GLsizeiptr size));
 MOCK_METHOD9(TexImage2D,
              void(GLenum target,
                   GLint level,

diff --git a/ui/gl/gl_stub_autogen_gl.h b/ui/gl/gl_stub_autogen_gl.h
index 6c3bc361..c0097eb 100644
--- a/ui/gl/gl_stub_autogen_gl.h
+++ b/ui/gl/gl_stub_autogen_gl.h

@@ -531,6 +531,7 @@
                                         GLsizei bufSize,
                                         GLsizei* length,
                                         GLint* params) override {}
+void glGetMultisamplefvFn(GLenum pname, GLuint index, GLfloat* val) override {}
 void glGetMultisamplefvRobustANGLEFn(GLenum pname,
                                      GLuint index,
                                      GLsizei bufSize,
@@ -873,6 +874,7 @@
 void glPauseTransformFeedbackFn() override {}
 void glPixelStoreiFn(GLenum pname, GLint param) override {}
 void glPointParameteriFn(GLenum pname, GLint param) override {}
+void glPolygonModeFn(GLenum face, GLenum mode) override {}
 void glPolygonOffsetFn(GLfloat factor, GLfloat units) override {}
 void glPopDebugGroupFn() override {}
 void glPopGroupMarkerEXTFn() override {}
@@ -1055,6 +1057,14 @@
                                       GLenum coverMode) override {}
 GLboolean glTestFenceAPPLEFn(GLuint fence) override;
 GLboolean glTestFenceNVFn(GLuint fence) override;
+void glTexBufferFn(GLenum target,
+                   GLenum internalformat,
+                   GLuint buffer) override {}
+void glTexBufferRangeFn(GLenum target,
+                        GLenum internalformat,
+                        GLuint buffer,
+                        GLintptr offset,
+                        GLsizeiptr size) override {}
 void glTexImage2DFn(GLenum target,
                     GLint level,
                     GLint internalformat,

diff --git a/ui/strings/ui_strings.grd b/ui/strings/ui_strings.grd
index 310e90a..db76cc8 100644
--- a/ui/strings/ui_strings.grd
+++ b/ui/strings/ui_strings.grd

@@ -757,7 +757,7 @@
         Expand to all apps
       </message>
       <message name="IDS_APP_LIST_CLEAR_SEARCHBOX" desc="Tooltip for the button that clears all text from the search box in the app list.">
-        Clear searchbox text button
+        Clear searchbox text
       </message>
 
       <!-- Strings describing the touch calibration UX -->

diff --git a/url/README.md b/url/README.md
new file mode 100644
index 0000000..412bd43b
--- /dev/null
+++ b/url/README.md

@@ -0,0 +1,75 @@
+# Chrome's URL library
+
+## Layers
+
+There are several conceptual layers in this directory. Going from the lowest
+level up, they are:
+
+### Parsing
+
+The `url_parse.*` files are the parser. This code does no string
+transformations. Its only job is to take an input string and splits out the
+components of the URL as best as it can deduce them, for a given type of URL.
+Parsing can never fail, it will take its best guess. This layer does not
+have logic for determining the type of URL parsing to apply, that needs to
+be applied at a higher layer (the "util" layer below).
+
+Because the parser code is derived (_very_ distantly) from some code in
+Mozilla, some of the parser files are in `url/third_party/mozilla/`.
+
+The main header to include for calling the parser is
+`url/third_party/mozilla/url_parse.h`.
+
+### Canonicalization
+
+The `url_canon*` files are the canonicalizer. This code will transform specific
+URL components or specific types of URLs into a standard form. For some
+dangerous or invalid data, the canonicalizer will report that a URL is invalid,
+although it will always try its best to produce output (so the calling code
+can, for example, show the user an error that the URL is invalid). The
+canonicalizer attempts to provide as consistent a representation as possible
+without changing the meaning of a URL.
+
+The canonicalizer layer is designed to be independent of the string type of
+the embedder, so all string output is done through a `CanonOutput` wrapper
+object. An implementation for `std::string` output is provided in
+`url_canon_stdstring.h`.
+
+The main header to include for calling the canonicalizer is
+`url/url_canon.h`.
+
+### Utility
+
+The `url_util*` files provide a higher-level wrapper around the parser and
+canonicalizer. While it can be called directly, it is designed to be the
+foundation for writing URL wrapper objects (The GURL later and Blink's KURL
+object use the Utility layer to implement the low-level logic).
+
+The Utility code makes decisions about URL types and calls the correct parsing
+and canonicalzation functions for those types. It provides an interface to
+register application-specific schemes that have specific requirements.
+Sharing this loigic between KURL and GURL is important so that URLs are
+handled consistently across the application.
+
+The main header to include is `url/url_util.h`.
+
+### GURL and Origin
+
+At the highest layer, a C++ object for representing URLs is provided. This
+object uses STL. Most uses need only this layer. Include `url/gurl.h`.
+
+Also at this layer is also the Origin object which exists to make security
+decisions on the web. Include `url/origin.h`.
+
+## Historical background
+
+This code was originally a separate library that was designed to be embedded
+into both Chrome (which uses STL) and WebKit (which didn't use any STL at the
+time). As a result, the parsing, canonicalization, and utility code could
+not use STL, or any other common code in Chromium like base.
+
+When WebKit was forked into the Chromium repo and renamed Blink, this
+restriction has been relaxed somewhat. Blink still provides its own URL object
+using its own string type, so the insulation that the Utility layer provides is
+still useful. But some STL strings and calls to base functions have gradually
+been added in places where doing so is possible.